)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"639438f4f10fab043d0e909e4e1c653df31f5d6b","unresolved":false,"context_lines":[{"line_number":7,"context_line":"virt: allow instances to be booted with trusted VFs"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"The inability to modify VF mac addresses in the guest prevents the"},{"line_number":10,"context_line":"users from being able to setup up two VFs in a fail-over bond."},{"line_number":11,"context_line":"This spec aims to provide a way for users to boot instances with trusted VFs."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Co-Authored-By: Vladik Romanovsky \u003cvromanso@redhat.com\u003e"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"7f515b1d_fac9315a","line":10,"range":{"start_line":10,"start_character":25,"end_line":10,"end_character":33},"updated":"2017-10-03 19:05:35.000000000","message":"set up","commit_id":"e4c87d15af084204fa1bd4d6cc7731cae8f97421"}],"specs/queens/approved/sriov-trusted-vfs.rst":[{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"639438f4f10fab043d0e909e4e1c653df31f5d6b","unresolved":false,"context_lines":[{"line_number":10,"context_line":""},{"line_number":11,"context_line":"https://blueprints.launchpad.net/nova/+spec/sriov-trusted-vfs"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"A new kernel feature allows Virtual Functions to become \"trusted\" by"},{"line_number":14,"context_line":"the Physical Function and perform some privileged operations, such as"},{"line_number":15,"context_line":"enabling VF promiscuous mode and changing VF MAC address within the"},{"line_number":16,"context_line":"guest. The inability to modify mac addresses in the guest prevents the"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7f515b1d_ba1f39b6","line":13,"range":{"start_line":13,"start_character":6,"end_line":13,"end_character":20},"updated":"2017-10-03 19:05:35.000000000","message":"please link to the patch or announcement and indicate the exact kernel versions this was introduced.","commit_id":"e4c87d15af084204fa1bd4d6cc7731cae8f97421"},{"author":{"_account_id":7166,"name":"Sylvain Bauza","email":"sbauza@redhat.com","username":"sbauza"},"change_message_id":"3cf9cdb6220a6842e6fba2036727f471c21e01bf","unresolved":false,"context_lines":[{"line_number":10,"context_line":""},{"line_number":11,"context_line":"https://blueprints.launchpad.net/nova/+spec/sriov-trusted-vfs"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"A new kernel feature allows Virtual Functions to become \"trusted\" by"},{"line_number":14,"context_line":"the Physical Function and perform some privileged operations, such as"},{"line_number":15,"context_line":"enabling VF promiscuous mode and changing VF MAC address within the"},{"line_number":16,"context_line":"guest. The inability to modify mac addresses in the guest prevents the"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5f4e5783_5598c619","line":13,"range":{"start_line":13,"start_character":6,"end_line":13,"end_character":20},"in_reply_to":"7f515b1d_ba1f39b6","updated":"2017-10-12 08:43:41.000000000","message":"Right, I suppose that feature will need a specific check for the feature. So, how can we provide a way to support old computes not providing that \u0027trusted\u0027 option ?","commit_id":"e4c87d15af084204fa1bd4d6cc7731cae8f97421"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"639438f4f10fab043d0e909e4e1c653df31f5d6b","unresolved":false,"context_lines":[{"line_number":13,"context_line":"A new kernel feature allows Virtual Functions to become \"trusted\" by"},{"line_number":14,"context_line":"the Physical Function and perform some privileged operations, such as"},{"line_number":15,"context_line":"enabling VF promiscuous mode and changing VF MAC address within the"},{"line_number":16,"context_line":"guest. The inability to modify mac addresses in the guest prevents the"},{"line_number":17,"context_line":"users from being able to easily setup up two VFs in a fail-over bond"},{"line_number":18,"context_line":"in a guest. This spec aims to suggest a way for users to boot"},{"line_number":19,"context_line":"instances with trusted VFs."},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"Problem description"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7f515b1d_bae2999f","line":18,"range":{"start_line":16,"start_character":7,"end_line":18,"end_character":11},"updated":"2017-10-03 19:05:35.000000000","message":"Why? What does not having the ability to change a guest\u0027s MAC address for an interface prevent the guest from setting up a fail-over bond? Could you elaborate a bit on this, please? I\u0027m familiar with an older Telefonica ask regarding being able to manually set a guest vNIC\u0027s MAC address because of hard-coded legacy software. Is that what you\u0027re alluding to here? Or is this something different?","commit_id":"e4c87d15af084204fa1bd4d6cc7731cae8f97421"},{"author":{"_account_id":14070,"name":"Eric Fried","email":"openstack@fried.cc","username":"efried"},"change_message_id":"5e93d90a175c9031e4a3e00521b92d14ce4bf28e","unresolved":false,"context_lines":[{"line_number":13,"context_line":"A new kernel feature allows Virtual Functions to become \"trusted\" by"},{"line_number":14,"context_line":"the Physical Function and perform some privileged operations, such as"},{"line_number":15,"context_line":"enabling VF promiscuous mode and changing VF MAC address within the"},{"line_number":16,"context_line":"guest. The inability to modify mac addresses in the guest prevents the"},{"line_number":17,"context_line":"users from being able to easily setup up two VFs in a fail-over bond"},{"line_number":18,"context_line":"in a guest. This spec aims to suggest a way for users to boot"},{"line_number":19,"context_line":"instances with trusted VFs."},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"Problem description"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7f515b1d_06c4af91","line":18,"range":{"start_line":16,"start_character":7,"end_line":18,"end_character":11},"in_reply_to":"7f515b1d_bae2999f","updated":"2017-10-03 21:30:10.000000000","message":"The two interfaces can\u0027t have the same MAC at the same time.  The failover process (when it\u0027s controlled by the guest) relies on being able to put the MAC from the failed VF onto the failover VF.","commit_id":"e4c87d15af084204fa1bd4d6cc7731cae8f97421"},{"author":{"_account_id":14070,"name":"Eric Fried","email":"openstack@fried.cc","username":"efried"},"change_message_id":"5e93d90a175c9031e4a3e00521b92d14ce4bf28e","unresolved":false,"context_lines":[{"line_number":23,"context_line":""},{"line_number":24,"context_line":"By default, Virtual Functions have no privileges to perform certain"},{"line_number":25,"context_line":"operations, such as enabling multicast promiscuous mode and modifying"},{"line_number":26,"context_line":"the VFs MAC address in the guest. These security measures are designed"},{"line_number":27,"context_line":"to prevent possible attacks, however, in some cases these operations"},{"line_number":28,"context_line":"performed by a VF would be legitimate. Openstack currently doesn\u0027t"},{"line_number":29,"context_line":"provide an easy way for a user to boot an instance with selected"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7f515b1d_a6ba7b07","line":26,"range":{"start_line":26,"start_character":4,"end_line":26,"end_character":7},"updated":"2017-10-03 21:30:10.000000000","message":"VF\u0027s or VFs\u0027","commit_id":"e4c87d15af084204fa1bd4d6cc7731cae8f97421"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"639438f4f10fab043d0e909e4e1c653df31f5d6b","unresolved":false,"context_lines":[{"line_number":28,"context_line":"performed by a VF would be legitimate. Openstack currently doesn\u0027t"},{"line_number":29,"context_line":"provide an easy way for a user to boot an instance with selected"},{"line_number":30,"context_line":"trusted VFs. As well as there is no easy way for cloud operators to"},{"line_number":31,"context_line":"specify with PFs allows it\u0027s VFs to become trusted."},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"Use Cases"},{"line_number":34,"context_line":"---------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7f515b1d_9a7b5dbd","line":31,"range":{"start_line":31,"start_character":24,"end_line":31,"end_character":28},"updated":"2017-10-03 19:05:35.000000000","message":"its","commit_id":"e4c87d15af084204fa1bd4d6cc7731cae8f97421"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"639438f4f10fab043d0e909e4e1c653df31f5d6b","unresolved":false,"context_lines":[{"line_number":28,"context_line":"performed by a VF would be legitimate. Openstack currently doesn\u0027t"},{"line_number":29,"context_line":"provide an easy way for a user to boot an instance with selected"},{"line_number":30,"context_line":"trusted VFs. As well as there is no easy way for cloud operators to"},{"line_number":31,"context_line":"specify with PFs allows it\u0027s VFs to become trusted."},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"Use Cases"},{"line_number":34,"context_line":"---------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7f515b1d_ba7e19ad","line":31,"range":{"start_line":31,"start_character":8,"end_line":31,"end_character":12},"updated":"2017-10-03 19:05:35.000000000","message":"which","commit_id":"e4c87d15af084204fa1bd4d6cc7731cae8f97421"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"639438f4f10fab043d0e909e4e1c653df31f5d6b","unresolved":false,"context_lines":[{"line_number":35,"context_line":""},{"line_number":36,"context_line":"There are several use cases in which users would prefer to take"},{"line_number":37,"context_line":"advantage of the trusted VFs. Bonding VFs in a guest would be one of"},{"line_number":38,"context_line":"these. Bonding modes that require all slaves to use the same MAC"},{"line_number":39,"context_line":"address, would require address modification on one of the VFs during a"},{"line_number":40,"context_line":"fail-over. As MAC address altering is a privileged operation,"},{"line_number":41,"context_line":"participating VFs should be trusted in order to successfully configure"},{"line_number":42,"context_line":"bonding in the guest. [1]_"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7f515b1d_754b125f","line":39,"range":{"start_line":38,"start_character":7,"end_line":39,"end_character":7},"updated":"2017-10-03 19:05:35.000000000","message":"which bonding modes are these? AFAICT, in an active-backup mode, you can set fail_over_mac\u003dfollow to allow slave interfaces to have different MAC addresses and have the bond MAC assume the primary interface\u0027s MAC upon failover.","commit_id":"e4c87d15af084204fa1bd4d6cc7731cae8f97421"},{"author":{"_account_id":7730,"name":"Sahid Orentino Ferdjaoui","email":"sahid.ferdjaoui@industrialdiscipline.com","username":"sahid"},"change_message_id":"cac74247e15eb89ff99c190569aaabe81d7390bc","unresolved":false,"context_lines":[{"line_number":35,"context_line":""},{"line_number":36,"context_line":"There are several use cases in which users would prefer to take"},{"line_number":37,"context_line":"advantage of the trusted VFs. Bonding VFs in a guest would be one of"},{"line_number":38,"context_line":"these. Bonding modes that require all slaves to use the same MAC"},{"line_number":39,"context_line":"address, would require address modification on one of the VFs during a"},{"line_number":40,"context_line":"fail-over. As MAC address altering is a privileged operation,"},{"line_number":41,"context_line":"participating VFs should be trusted in order to successfully configure"},{"line_number":42,"context_line":"bonding in the guest. [1]_"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7f515b1d_ab39e6a3","line":39,"range":{"start_line":38,"start_character":7,"end_line":39,"end_character":7},"in_reply_to":"7f515b1d_43d01cf8","updated":"2017-10-05 15:26:18.000000000","message":"I thought that Eric responded to you.\n\nWhat kind of detail do you need? The fail-over bond with SRIOV can work only with fail_over_mac\u003dactive and that because what I do have mentioned previously. It\u0027s guest OS which does the switching.\n\nYou have two physical devices connected to two different physical switch. You pick one SRIOV NIC from each - One is master and the other slave. At the point where the master fails the guest switch the traffic to the slave. You need to change the MAC of the slave to be the same of the master that because SRIOV functions embed traffic filters which do not allow to send any traffic from no-local MAC address.\n\n(I\u0027m sure you already know all of that I\u0027m just not sure of what exactly is your question)\n\nIt\u0027s not related to that Telefonica ask.","commit_id":"e4c87d15af084204fa1bd4d6cc7731cae8f97421"},{"author":{"_account_id":14070,"name":"Eric Fried","email":"openstack@fried.cc","username":"efried"},"change_message_id":"5e93d90a175c9031e4a3e00521b92d14ce4bf28e","unresolved":false,"context_lines":[{"line_number":35,"context_line":""},{"line_number":36,"context_line":"There are several use cases in which users would prefer to take"},{"line_number":37,"context_line":"advantage of the trusted VFs. Bonding VFs in a guest would be one of"},{"line_number":38,"context_line":"these. Bonding modes that require all slaves to use the same MAC"},{"line_number":39,"context_line":"address, would require address modification on one of the VFs during a"},{"line_number":40,"context_line":"fail-over. As MAC address altering is a privileged operation,"},{"line_number":41,"context_line":"participating VFs should be trusted in order to successfully configure"},{"line_number":42,"context_line":"bonding in the guest. [1]_"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7f515b1d_c66b3783","line":39,"range":{"start_line":38,"start_character":7,"end_line":39,"end_character":7},"in_reply_to":"7f515b1d_754b125f","updated":"2017-10-03 21:30:10.000000000","message":"Oh, maybe that\u0027s a thing too.","commit_id":"e4c87d15af084204fa1bd4d6cc7731cae8f97421"},{"author":{"_account_id":7730,"name":"Sahid Orentino Ferdjaoui","email":"sahid.ferdjaoui@industrialdiscipline.com","username":"sahid"},"change_message_id":"7950b7bad92be28fae7dde6f9fc36cab4f816deb","unresolved":false,"context_lines":[{"line_number":35,"context_line":""},{"line_number":36,"context_line":"There are several use cases in which users would prefer to take"},{"line_number":37,"context_line":"advantage of the trusted VFs. Bonding VFs in a guest would be one of"},{"line_number":38,"context_line":"these. Bonding modes that require all slaves to use the same MAC"},{"line_number":39,"context_line":"address, would require address modification on one of the VFs during a"},{"line_number":40,"context_line":"fail-over. As MAC address altering is a privileged operation,"},{"line_number":41,"context_line":"participating VFs should be trusted in order to successfully configure"},{"line_number":42,"context_line":"bonding in the guest. [1]_"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7f515b1d_f59d8d0a","line":39,"range":{"start_line":38,"start_character":7,"end_line":39,"end_character":7},"in_reply_to":"7f515b1d_850d23ea","updated":"2017-10-05 07:09:23.000000000","message":"You can\u0027t use \u0027fail_over_mac\u003dfollow\u0027 with SRIOV. There is an internal filter which is going to drop any traffic sent with the non-local source MAC address.\n\nThat is said it\u0027s also not possible to use \u0027fail_over_mac\u003dnone\u0027. For SRIOV the use case is limited to \u0027fail_over_mac\u003dactive\u0027. We want the bond to change the slave MAC address.\n\nI will rewrote a big that part.","commit_id":"e4c87d15af084204fa1bd4d6cc7731cae8f97421"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"d266f8bbfde9f151fcaf85c381c4a6edd2a4d6f1","unresolved":false,"context_lines":[{"line_number":35,"context_line":""},{"line_number":36,"context_line":"There are several use cases in which users would prefer to take"},{"line_number":37,"context_line":"advantage of the trusted VFs. Bonding VFs in a guest would be one of"},{"line_number":38,"context_line":"these. Bonding modes that require all slaves to use the same MAC"},{"line_number":39,"context_line":"address, would require address modification on one of the VFs during a"},{"line_number":40,"context_line":"fail-over. As MAC address altering is a privileged operation,"},{"line_number":41,"context_line":"participating VFs should be trusted in order to successfully configure"},{"line_number":42,"context_line":"bonding in the guest. [1]_"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7f515b1d_850d23ea","line":39,"range":{"start_line":38,"start_character":7,"end_line":39,"end_character":7},"in_reply_to":"7f515b1d_c66b3783","updated":"2017-10-04 12:51:07.000000000","message":"Yeah, that\u0027s why I want to ensure that we\u0027re not hacking in a \"solution\" to a \"problem\" that doesn\u0027t actually exist.","commit_id":"e4c87d15af084204fa1bd4d6cc7731cae8f97421"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"0f83e3de7ac897a30a6860bda488ded1cc05d30a","unresolved":false,"context_lines":[{"line_number":35,"context_line":""},{"line_number":36,"context_line":"There are several use cases in which users would prefer to take"},{"line_number":37,"context_line":"advantage of the trusted VFs. Bonding VFs in a guest would be one of"},{"line_number":38,"context_line":"these. Bonding modes that require all slaves to use the same MAC"},{"line_number":39,"context_line":"address, would require address modification on one of the VFs during a"},{"line_number":40,"context_line":"fail-over. As MAC address altering is a privileged operation,"},{"line_number":41,"context_line":"participating VFs should be trusted in order to successfully configure"},{"line_number":42,"context_line":"bonding in the guest. [1]_"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7f515b1d_43d01cf8","line":39,"range":{"start_line":38,"start_character":7,"end_line":39,"end_character":7},"in_reply_to":"7f515b1d_f59d8d0a","updated":"2017-10-05 14:19:21.000000000","message":"Sahid, if you get a chance, could you answer my questions on line 18? Thanks!","commit_id":"e4c87d15af084204fa1bd4d6cc7731cae8f97421"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"639438f4f10fab043d0e909e4e1c653df31f5d6b","unresolved":false,"context_lines":[{"line_number":45,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"The aim of this proposal is to provide a comfortable way for users to"},{"line_number":48,"context_line":"boot instances with as assigned SR-IOV VFs which will be configured as"},{"line_number":49,"context_line":"trusted. Cloud operators would have a manageable way to specify which"},{"line_number":50,"context_line":"PFs will allow trusted VFs to be configured."},{"line_number":51,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"7f515b1d_155a9e29","line":48,"range":{"start_line":48,"start_character":15,"end_line":48,"end_character":23},"updated":"2017-10-03 19:05:35.000000000","message":"with assigned","commit_id":"e4c87d15af084204fa1bd4d6cc7731cae8f97421"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"639438f4f10fab043d0e909e4e1c653df31f5d6b","unresolved":false,"context_lines":[{"line_number":57,"context_line":""},{"line_number":58,"context_line":"    [pci]"},{"line_number":59,"context_line":"    passthrough_whitelist \u003d {\"devname\": \"eth0\","},{"line_number":60,"context_line":"                             \"trusted\": \"true\","},{"line_number":61,"context_line":"\t\t\t     \"physical_network\": \"phys0\"}"},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"In Neutron the ports will have to be created with specific bindings to"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7f515b1d_edc0567f","line":60,"range":{"start_line":60,"start_character":0,"end_line":60,"end_character":47},"updated":"2017-10-03 19:05:35.000000000","message":"this is exactly what we *don\u0027t* want to add to the pci_passthrough_whitelist. We want the whitelist to only be for specifying the devices that a host allows a guest to consume. We don\u0027t want the whitelist to do \"double duty\" of also being a place where we assign traits to individual devices.","commit_id":"e4c87d15af084204fa1bd4d6cc7731cae8f97421"},{"author":{"_account_id":7166,"name":"Sylvain Bauza","email":"sbauza@redhat.com","username":"sbauza"},"change_message_id":"3cf9cdb6220a6842e6fba2036727f471c21e01bf","unresolved":false,"context_lines":[{"line_number":57,"context_line":""},{"line_number":58,"context_line":"    [pci]"},{"line_number":59,"context_line":"    passthrough_whitelist \u003d {\"devname\": \"eth0\","},{"line_number":60,"context_line":"                             \"trusted\": \"true\","},{"line_number":61,"context_line":"\t\t\t     \"physical_network\": \"phys0\"}"},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"In Neutron the ports will have to be created with specific bindings to"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5f4e5783_b01ca86a","line":60,"range":{"start_line":60,"start_character":0,"end_line":60,"end_character":47},"in_reply_to":"7f515b1d_55034110","updated":"2017-10-12 08:43:41.000000000","message":"The problem I see with the above whitelist modification is that it\u0027s not about saying *which* devices to use, rather to say \"I only want those devices, but please trust them\" which is a different situation.\n\nWhy should I as an operator do that ? Instead, maybe just saying \u0027I want those devices\u0027 in the whitelist should be enough, if I would document the specific \"capability\" (we call that a \"trait\") for each PF. For example, you could imagine yet another kernel feature called \"foo\" for that PF, that would just be another \"capability\".","commit_id":"e4c87d15af084204fa1bd4d6cc7731cae8f97421"},{"author":{"_account_id":7730,"name":"Sahid Orentino Ferdjaoui","email":"sahid.ferdjaoui@industrialdiscipline.com","username":"sahid"},"change_message_id":"7950b7bad92be28fae7dde6f9fc36cab4f816deb","unresolved":false,"context_lines":[{"line_number":57,"context_line":""},{"line_number":58,"context_line":"    [pci]"},{"line_number":59,"context_line":"    passthrough_whitelist \u003d {\"devname\": \"eth0\","},{"line_number":60,"context_line":"                             \"trusted\": \"true\","},{"line_number":61,"context_line":"\t\t\t     \"physical_network\": \"phys0\"}"},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"In Neutron the ports will have to be created with specific bindings to"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7f515b1d_55034110","line":60,"range":{"start_line":60,"start_character":0,"end_line":60,"end_character":47},"in_reply_to":"7f515b1d_edc0567f","updated":"2017-10-05 07:09:23.000000000","message":"The device does not report such capability. It\u0027s related to the host kernel. The I aim is to allow operators to say I want this set of devices allowed to be configured with trusted mode.\n\nHow to achieve this?","commit_id":"e4c87d15af084204fa1bd4d6cc7731cae8f97421"},{"author":{"_account_id":14070,"name":"Eric Fried","email":"openstack@fried.cc","username":"efried"},"change_message_id":"5e93d90a175c9031e4a3e00521b92d14ce4bf28e","unresolved":false,"context_lines":[{"line_number":58,"context_line":"    [pci]"},{"line_number":59,"context_line":"    passthrough_whitelist \u003d {\"devname\": \"eth0\","},{"line_number":60,"context_line":"                             \"trusted\": \"true\","},{"line_number":61,"context_line":"\t\t\t     \"physical_network\": \"phys0\"}"},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"In Neutron the ports will have to be created with specific bindings to"},{"line_number":64,"context_line":"match the tag so Nova will schedule the VM on a host which provides"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7f515b1d_b5bd0a04","line":61,"range":{"start_line":61,"start_character":0,"end_line":61,"end_character":7},"updated":"2017-10-03 21:30:10.000000000","message":"icky icky tabs","commit_id":"e4c87d15af084204fa1bd4d6cc7731cae8f97421"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"639438f4f10fab043d0e909e4e1c653df31f5d6b","unresolved":false,"context_lines":[{"line_number":69,"context_line":"    neutron port-create \u003cnet-id\u003e \\"},{"line_number":70,"context_line":"                        --name sriov_port \\"},{"line_number":71,"context_line":"                        --vnic-type direct \\"},{"line_number":72,"context_line":"                        --binding:profile type\u003ddict trusted\u003dtrue"},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"NOTE: After the instance destruction, VFs which have been configured"},{"line_number":75,"context_line":"with the bit trust will be cleared."}],"source_content_type":"text/x-rst","patch_set":2,"id":"7f515b1d_4d588af9","line":72,"range":{"start_line":72,"start_character":51,"end_line":72,"end_character":64},"updated":"2017-10-03 19:05:35.000000000","message":"Is there a standard os-traits trait string that should be added for SR-IOV physical functions to advertise they have the capability to have trusted VFs?\n\nhttps://github.com/openstack/os-traits/blob/master/os_traits/hw/nic/sriov.py","commit_id":"e4c87d15af084204fa1bd4d6cc7731cae8f97421"},{"author":{"_account_id":7730,"name":"Sahid Orentino Ferdjaoui","email":"sahid.ferdjaoui@industrialdiscipline.com","username":"sahid"},"change_message_id":"7950b7bad92be28fae7dde6f9fc36cab4f816deb","unresolved":false,"context_lines":[{"line_number":69,"context_line":"    neutron port-create \u003cnet-id\u003e \\"},{"line_number":70,"context_line":"                        --name sriov_port \\"},{"line_number":71,"context_line":"                        --vnic-type direct \\"},{"line_number":72,"context_line":"                        --binding:profile type\u003ddict trusted\u003dtrue"},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"NOTE: After the instance destruction, VFs which have been configured"},{"line_number":75,"context_line":"with the bit trust will be cleared."}],"source_content_type":"text/x-rst","patch_set":2,"id":"7f515b1d_980e9030","line":72,"range":{"start_line":72,"start_character":51,"end_line":72,"end_character":64},"in_reply_to":"7f515b1d_4d588af9","updated":"2017-10-05 07:09:23.000000000","message":"Yes we could have a TRUSTED string to request such device. Please see my question line 60.","commit_id":"e4c87d15af084204fa1bd4d6cc7731cae8f97421"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"639438f4f10fab043d0e909e4e1c653df31f5d6b","unresolved":false,"context_lines":[{"line_number":77,"context_line":"Alternatives"},{"line_number":78,"context_line":"------------"},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"The operator will have to manually configure VFs as trust in the"},{"line_number":81,"context_line":"compute nodes."},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"Data model impact"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7f515b1d_6d08e6d8","line":80,"range":{"start_line":80,"start_character":52,"end_line":80,"end_character":57},"updated":"2017-10-03 19:05:35.000000000","message":"trusted","commit_id":"e4c87d15af084204fa1bd4d6cc7731cae8f97421"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"639438f4f10fab043d0e909e4e1c653df31f5d6b","unresolved":false,"context_lines":[{"line_number":155,"context_line":"Testing"},{"line_number":156,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":157,"context_line":""},{"line_number":158,"context_line":"New unit tests will be written to cover the changes."},{"line_number":159,"context_line":""},{"line_number":160,"context_line":"Documentation Impact"},{"line_number":161,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7f515b1d_ed1cd614","line":158,"range":{"start_line":158,"start_character":1,"end_line":158,"end_character":52},"updated":"2017-10-03 19:05:35.000000000","message":"New functional tests should be required.","commit_id":"e4c87d15af084204fa1bd4d6cc7731cae8f97421"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"1e210c947d1c4c1f90b068941cc31bf992035e4a","unresolved":false,"context_lines":[{"line_number":12,"context_line":""},{"line_number":13,"context_line":"In order to enable VF (SR-IOV virtual function) to request \"trusted"},{"line_number":14,"context_line":"mode\", a new trusted VF concept was introduced in linux kernel 4.4"},{"line_number":15,"context_line":"[0]."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"It allows Virtual Functions to become \"trusted\" by the Physical"},{"line_number":18,"context_line":"Function and perform some privileged operations, such as enabling VF"}],"source_content_type":"text/x-rst","patch_set":3,"id":"3f4b6375_faf7c3f4","line":15,"range":{"start_line":15,"start_character":0,"end_line":15,"end_character":3},"updated":"2017-10-19 18:06:44.000000000","message":"there is no [0] link in the references section below :)","commit_id":"9c3dd088e3083658bdd96c3d18499106243627c2"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"1e210c947d1c4c1f90b068941cc31bf992035e4a","unresolved":false,"context_lines":[{"line_number":17,"context_line":"It allows Virtual Functions to become \"trusted\" by the Physical"},{"line_number":18,"context_line":"Function and perform some privileged operations, such as enabling VF"},{"line_number":19,"context_line":"promiscuous mode and changing VF MAC address within the guest. The"},{"line_number":20,"context_line":"inability to modify mac addresses in the guest prevents the users from"},{"line_number":21,"context_line":"being able to easily setup up two VFs in a fail-over bond in a"},{"line_number":22,"context_line":"guest. This spec aims to suggest a way for users to boot instances"},{"line_number":23,"context_line":"with trusted VFs."}],"source_content_type":"text/x-rst","patch_set":3,"id":"3f4b6375_fad0e352","line":20,"range":{"start_line":20,"start_character":20,"end_line":20,"end_character":23},"updated":"2017-10-19 18:06:44.000000000","message":"MAC","commit_id":"9c3dd088e3083658bdd96c3d18499106243627c2"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"1e210c947d1c4c1f90b068941cc31bf992035e4a","unresolved":false,"context_lines":[{"line_number":18,"context_line":"Function and perform some privileged operations, such as enabling VF"},{"line_number":19,"context_line":"promiscuous mode and changing VF MAC address within the guest. The"},{"line_number":20,"context_line":"inability to modify mac addresses in the guest prevents the users from"},{"line_number":21,"context_line":"being able to easily setup up two VFs in a fail-over bond in a"},{"line_number":22,"context_line":"guest. This spec aims to suggest a way for users to boot instances"},{"line_number":23,"context_line":"with trusted VFs."},{"line_number":24,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"3f4b6375_5a37f7b1","line":21,"range":{"start_line":21,"start_character":21,"end_line":21,"end_character":29},"updated":"2017-10-19 18:06:44.000000000","message":"set up","commit_id":"9c3dd088e3083658bdd96c3d18499106243627c2"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"bc672ab4bb42673d0a61bda104b1da0a09bb9c3f","unresolved":false,"context_lines":[{"line_number":19,"context_line":"promiscuous mode and changing VF MAC address within the guest. The"},{"line_number":20,"context_line":"inability to modify mac addresses in the guest prevents the users from"},{"line_number":21,"context_line":"being able to easily setup up two VFs in a fail-over bond in a"},{"line_number":22,"context_line":"guest. This spec aims to suggest a way for users to boot instances"},{"line_number":23,"context_line":"with trusted VFs."},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"Problem description"},{"line_number":26,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":3,"id":"3f4b6375_6588ddc5","line":23,"range":{"start_line":22,"start_character":6,"end_line":23,"end_character":17},"updated":"2017-10-19 11:41:45.000000000","message":"in a private cloud model this may be acceptable but i dont think standard users should be able to request this feature.\n\nperhaps this could be controlled via private flavors but this is a networking feature that should really be requested via neutron.","commit_id":"9c3dd088e3083658bdd96c3d18499106243627c2"},{"author":{"_account_id":7730,"name":"Sahid Orentino Ferdjaoui","email":"sahid.ferdjaoui@industrialdiscipline.com","username":"sahid"},"change_message_id":"f5c77c2a38115e2e517ae7a3264c8adc97878ba9","unresolved":false,"context_lines":[{"line_number":19,"context_line":"promiscuous mode and changing VF MAC address within the guest. The"},{"line_number":20,"context_line":"inability to modify mac addresses in the guest prevents the users from"},{"line_number":21,"context_line":"being able to easily setup up two VFs in a fail-over bond in a"},{"line_number":22,"context_line":"guest. This spec aims to suggest a way for users to boot instances"},{"line_number":23,"context_line":"with trusted VFs."},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"Problem description"},{"line_number":26,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":3,"id":"3f4b6375_a856ac05","line":23,"range":{"start_line":22,"start_character":6,"end_line":23,"end_character":17},"in_reply_to":"3f4b6375_6588ddc5","updated":"2017-10-19 11:55:27.000000000","message":"\u003e in a private cloud model this may be acceptable but i dont think standard users should be able to request this feature.\n\nI agreed bunch of the features NFV related are for private cloud. I don\u0027t think there is a problem with that.\n\n\u003e perhaps this could be controlled via private flavors but this is a networking feature that should really be requested via neutron.\n\nThat is going to be controlled by flavors. The hosts supporting this feature will have to be isolated on a aggregate, only supported flavors can boot VMs in that aggregate.\n\nActually this should be an os-vif feature where Nova is requesting to configure a PF to be trusted but we do not have in os-vif the code to handle vif type direct","commit_id":"9c3dd088e3083658bdd96c3d18499106243627c2"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"bc672ab4bb42673d0a61bda104b1da0a09bb9c3f","unresolved":false,"context_lines":[{"line_number":37,"context_line":"Use Cases"},{"line_number":38,"context_line":"---------"},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"There are several use cases in which users would prefer to take"},{"line_number":41,"context_line":"advantage of the trusted VFs. Bonding VFs in a guest would be one of"},{"line_number":42,"context_line":"these. Bonding modes that require all slaves to use the same MAC"},{"line_number":43,"context_line":"address, would require address modification on one of the VFs during a"},{"line_number":44,"context_line":"fail-over. As MAC address altering is a privileged operation,"},{"line_number":45,"context_line":"participating VFs should be trusted in order to successfully configure"},{"line_number":46,"context_line":"bonding in the guest. [1]_"},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"Proposed change"},{"line_number":49,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":3,"id":"3f4b6375_c5c2f1e9","line":46,"range":{"start_line":40,"start_character":0,"end_line":46,"end_character":26},"updated":"2017-10-19 11:41:45.000000000","message":"why can tese usecase not be fufilled with sriov direct passthough? e.g. pci passthough of the full nic via neutron.\n\nthat would allow you to update the mac on the neutron port and which would allow you to do switch level mac/vlan anti spoof protection which can be disable if really need by disableing port security on the neutron port.","commit_id":"9c3dd088e3083658bdd96c3d18499106243627c2"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"1e210c947d1c4c1f90b068941cc31bf992035e4a","unresolved":false,"context_lines":[{"line_number":37,"context_line":"Use Cases"},{"line_number":38,"context_line":"---------"},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"There are several use cases in which users would prefer to take"},{"line_number":41,"context_line":"advantage of the trusted VFs. Bonding VFs in a guest would be one of"},{"line_number":42,"context_line":"these. Bonding modes that require all slaves to use the same MAC"},{"line_number":43,"context_line":"address, would require address modification on one of the VFs during a"},{"line_number":44,"context_line":"fail-over. As MAC address altering is a privileged operation,"},{"line_number":45,"context_line":"participating VFs should be trusted in order to successfully configure"},{"line_number":46,"context_line":"bonding in the guest. [1]_"},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"Proposed change"},{"line_number":49,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":3,"id":"3f4b6375_ba3dcbbc","line":46,"range":{"start_line":40,"start_character":0,"end_line":46,"end_character":26},"in_reply_to":"3f4b6375_486618f0","updated":"2017-10-19 18:06:44.000000000","message":"Sean is asking about passing through the PF, not the VF, and then having the guest have full control over whatever it wants to do with the VFs on that PF (since it has full privileges on the host PF device).\n\nAnyway, to answer your question Sean, yes, you could do that. The problem is that that just pushes orchestration of the VFs into the guest instead of making the VFs \"just another resource\" that is tracked and managed by Nova/Neutron/Placement. So, it\u0027s just pushing the problem to the guest to handle and means that there will be little granular control over the virtual resources on the compute nodes.","commit_id":"9c3dd088e3083658bdd96c3d18499106243627c2"},{"author":{"_account_id":7730,"name":"Sahid Orentino Ferdjaoui","email":"sahid.ferdjaoui@industrialdiscipline.com","username":"sahid"},"change_message_id":"f5c77c2a38115e2e517ae7a3264c8adc97878ba9","unresolved":false,"context_lines":[{"line_number":37,"context_line":"Use Cases"},{"line_number":38,"context_line":"---------"},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"There are several use cases in which users would prefer to take"},{"line_number":41,"context_line":"advantage of the trusted VFs. Bonding VFs in a guest would be one of"},{"line_number":42,"context_line":"these. Bonding modes that require all slaves to use the same MAC"},{"line_number":43,"context_line":"address, would require address modification on one of the VFs during a"},{"line_number":44,"context_line":"fail-over. As MAC address altering is a privileged operation,"},{"line_number":45,"context_line":"participating VFs should be trusted in order to successfully configure"},{"line_number":46,"context_line":"bonding in the guest. [1]_"},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"Proposed change"},{"line_number":49,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":3,"id":"3f4b6375_486618f0","line":46,"range":{"start_line":40,"start_character":0,"end_line":46,"end_character":26},"in_reply_to":"3f4b6375_c5c2f1e9","updated":"2017-10-19 11:55:27.000000000","message":"You can\u0027t do that. virtual functions embed filtering which does not allow to send traffics from no local MAC address.","commit_id":"9c3dd088e3083658bdd96c3d18499106243627c2"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"bc672ab4bb42673d0a61bda104b1da0a09bb9c3f","unresolved":false,"context_lines":[{"line_number":59,"context_line":""},{"line_number":60,"context_line":".. code::"},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"    neutron port-create \u003cnet-id\u003e \\"},{"line_number":63,"context_line":"                        --name sriov_port \\"},{"line_number":64,"context_line":"                        --vnic-type direct \\"},{"line_number":65,"context_line":"                        --binding:profile type\u003ddict trusted\u003dtrue"},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"Alternatives"},{"line_number":68,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":3,"id":"3f4b6375_857199e3","line":65,"range":{"start_line":62,"start_character":4,"end_line":65,"end_character":64},"updated":"2017-10-19 11:41:45.000000000","message":"this really looks like it should be a neutron spec not a nova one.","commit_id":"9c3dd088e3083658bdd96c3d18499106243627c2"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"bc672ab4bb42673d0a61bda104b1da0a09bb9c3f","unresolved":false,"context_lines":[{"line_number":83,"context_line":"Security impact"},{"line_number":84,"context_line":"---------------"},{"line_number":85,"context_line":""},{"line_number":86,"context_line":"Some security issue are associated with the trusted VFs feature. As"},{"line_number":87,"context_line":"noted above, trusted VFs can be set into VF promiscuous mode which"},{"line_number":88,"context_line":"will enable sniffing and monitoring of the entire physical port for"},{"line_number":89,"context_line":"incoming traffic, including traffic targeting other virtual"},{"line_number":90,"context_line":"functions. [2]_ [3]_ It will be up to the deployer to decide whether"},{"line_number":91,"context_line":"the security issue is manageable."},{"line_number":92,"context_line":""},{"line_number":93,"context_line":"Notifications impact"},{"line_number":94,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":3,"id":"3f4b6375_45004135","line":91,"range":{"start_line":86,"start_character":0,"end_line":91,"end_character":33},"updated":"2017-10-19 11:41:45.000000000","message":"you are also allowing the vf to change its mac so you can also impersonate any vf on the same vlan. if they can also update or disable the vlan fileter they can impersonate any vm on any neutron provider net connected to that physical interface.","commit_id":"9c3dd088e3083658bdd96c3d18499106243627c2"},{"author":{"_account_id":7730,"name":"Sahid Orentino Ferdjaoui","email":"sahid.ferdjaoui@industrialdiscipline.com","username":"sahid"},"change_message_id":"f5c77c2a38115e2e517ae7a3264c8adc97878ba9","unresolved":false,"context_lines":[{"line_number":83,"context_line":"Security impact"},{"line_number":84,"context_line":"---------------"},{"line_number":85,"context_line":""},{"line_number":86,"context_line":"Some security issue are associated with the trusted VFs feature. As"},{"line_number":87,"context_line":"noted above, trusted VFs can be set into VF promiscuous mode which"},{"line_number":88,"context_line":"will enable sniffing and monitoring of the entire physical port for"},{"line_number":89,"context_line":"incoming traffic, including traffic targeting other virtual"},{"line_number":90,"context_line":"functions. [2]_ [3]_ It will be up to the deployer to decide whether"},{"line_number":91,"context_line":"the security issue is manageable."},{"line_number":92,"context_line":""},{"line_number":93,"context_line":"Notifications impact"},{"line_number":94,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":3,"id":"3f4b6375_e89a64c3","line":91,"range":{"start_line":86,"start_character":0,"end_line":91,"end_character":33},"in_reply_to":"3f4b6375_45004135","updated":"2017-10-19 11:55:27.000000000","message":"It\u0027s all mentioned and the deployer who is going to enable this feature should be aware of that.","commit_id":"9c3dd088e3083658bdd96c3d18499106243627c2"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"5a4ac815c8ee8fe22fa6d2b45e4c5db5a6e4d6d4","unresolved":false,"context_lines":[{"line_number":83,"context_line":"Security impact"},{"line_number":84,"context_line":"---------------"},{"line_number":85,"context_line":""},{"line_number":86,"context_line":"Some security issue are associated with the trusted VFs feature. As"},{"line_number":87,"context_line":"noted above, trusted VFs can be set into VF promiscuous mode which"},{"line_number":88,"context_line":"will enable sniffing and monitoring of the entire physical port for"},{"line_number":89,"context_line":"incoming traffic, including traffic targeting other virtual"},{"line_number":90,"context_line":"functions. [2]_ [3]_ It will be up to the deployer to decide whether"},{"line_number":91,"context_line":"the security issue is manageable."},{"line_number":92,"context_line":""},{"line_number":93,"context_line":"Notifications impact"},{"line_number":94,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":3,"id":"3f4b6375_6812f45a","line":91,"range":{"start_line":86,"start_character":0,"end_line":91,"end_character":33},"in_reply_to":"3f4b6375_45004135","updated":"2017-10-19 11:47:18.000000000","message":"if you need multiple mac or ips you can also use the allow adress pairs in neutron.","commit_id":"9c3dd088e3083658bdd96c3d18499106243627c2"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"bc672ab4bb42673d0a61bda104b1da0a09bb9c3f","unresolved":false,"context_lines":[{"line_number":104,"context_line":"Performance Impact"},{"line_number":105,"context_line":"------------------"},{"line_number":106,"context_line":""},{"line_number":107,"context_line":"N/A"},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"Other deployer impact"},{"line_number":110,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":3,"id":"3f4b6375_45d721c1","line":107,"range":{"start_line":107,"start_character":0,"end_line":107,"end_character":3},"updated":"2017-10-19 11:41:45.000000000","message":"allowing guest to work in promiscuous mode will have a significant performance impact on all tenant in host as it requires the nic to effectively flood all traffic received to all promiscuous vf.","commit_id":"9c3dd088e3083658bdd96c3d18499106243627c2"},{"author":{"_account_id":7730,"name":"Sahid Orentino Ferdjaoui","email":"sahid.ferdjaoui@industrialdiscipline.com","username":"sahid"},"change_message_id":"7a4992238587a13d1c07623988f04dcb40bd8abc","unresolved":false,"context_lines":[{"line_number":104,"context_line":"Performance Impact"},{"line_number":105,"context_line":"------------------"},{"line_number":106,"context_line":""},{"line_number":107,"context_line":"N/A"},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"Other deployer impact"},{"line_number":110,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":3,"id":"3f4b6375_882c1048","line":107,"range":{"start_line":107,"start_character":0,"end_line":107,"end_character":3},"in_reply_to":"3f4b6375_08b5c031","updated":"2017-10-19 12:02:19.000000000","message":"I just noticed your pointer. Basically using trusted allow to configure promisc mode but we do not enable it. The security section make it clear, having PF set to trusted allow promisc mode. Deployer will know the risk.\n\nI can still update the section but not sure if that make sense since it\u0027s not the aim of this spec.","commit_id":"9c3dd088e3083658bdd96c3d18499106243627c2"},{"author":{"_account_id":7730,"name":"Sahid Orentino Ferdjaoui","email":"sahid.ferdjaoui@industrialdiscipline.com","username":"sahid"},"change_message_id":"f5c77c2a38115e2e517ae7a3264c8adc97878ba9","unresolved":false,"context_lines":[{"line_number":104,"context_line":"Performance Impact"},{"line_number":105,"context_line":"------------------"},{"line_number":106,"context_line":""},{"line_number":107,"context_line":"N/A"},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"Other deployer impact"},{"line_number":110,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":3,"id":"3f4b6375_08b5c031","line":107,"range":{"start_line":107,"start_character":0,"end_line":107,"end_character":3},"in_reply_to":"3f4b6375_45d721c1","updated":"2017-10-19 11:55:27.000000000","message":"Interesting, do do have pointer so I can update this part?","commit_id":"9c3dd088e3083658bdd96c3d18499106243627c2"},{"author":{"_account_id":11604,"name":"sean mooney","email":"smooney@redhat.com","username":"sean-k-mooney"},"change_message_id":"5a4ac815c8ee8fe22fa6d2b45e4c5db5a6e4d6d4","unresolved":false,"context_lines":[{"line_number":104,"context_line":"Performance Impact"},{"line_number":105,"context_line":"------------------"},{"line_number":106,"context_line":""},{"line_number":107,"context_line":"N/A"},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"Other deployer impact"},{"line_number":110,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":3,"id":"3f4b6375_2507851f","line":107,"range":{"start_line":107,"start_character":0,"end_line":107,"end_character":3},"in_reply_to":"3f4b6375_45d721c1","updated":"2017-10-19 11:47:18.000000000","message":"by the way you should review \nhttps://www.youtube.com/watch?v\u003dZEoTlC-gLBE\naround 17 mins in to see the context of the perfomance impact.","commit_id":"9c3dd088e3083658bdd96c3d18499106243627c2"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"1e210c947d1c4c1f90b068941cc31bf992035e4a","unresolved":false,"context_lines":[{"line_number":135,"context_line":"Work Items"},{"line_number":136,"context_line":"----------"},{"line_number":137,"context_line":""},{"line_number":138,"context_line":"- Adding command to configure tursted mode for VFs"},{"line_number":139,"context_line":"- Updating PCI Request Spec to handle trusted tags"},{"line_number":140,"context_line":"- Configuring trust mode for VFs on libvirt driver."},{"line_number":141,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"3f4b6375_da976790","line":138,"range":{"start_line":138,"start_character":30,"end_line":138,"end_character":37},"updated":"2017-10-19 18:06:44.000000000","message":"trusted","commit_id":"9c3dd088e3083658bdd96c3d18499106243627c2"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"1e210c947d1c4c1f90b068941cc31bf992035e4a","unresolved":false,"context_lines":[{"line_number":159,"context_line":"References"},{"line_number":160,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":161,"context_line":""},{"line_number":162,"context_line":".. [1] https://communities.intel.com/thread/54061 or https://access.redhat.com/solutions/355853"},{"line_number":163,"context_line":".. [2] https://community.mellanox.com/docs/DOC-2473"},{"line_number":164,"context_line":".. [3] http://events.linuxfoundation.org/sites/events/files/slides/20160715_LinuxCon_sriov_final.pdf"},{"line_number":165,"context_line":".. [4] https://review.openstack.org/#/c/182242/"}],"source_content_type":"text/x-rst","patch_set":3,"id":"3f4b6375_7a8e3379","line":162,"range":{"start_line":162,"start_character":53,"end_line":162,"end_character":95},"updated":"2017-10-19 18:06:44.000000000","message":"This is a blocked link for paying Red Hat customers. Please remove it since it\u0027s not accessible for non-customers.","commit_id":"9c3dd088e3083658bdd96c3d18499106243627c2"},{"author":{"_account_id":6681,"name":"Brent Eagles","email":"beagles@redhat.com","username":"beagles"},"change_message_id":"327981d8c1b19cc975af8492fc8099d684fa27ed","unresolved":false,"context_lines":[{"line_number":137,"context_line":""},{"line_number":138,"context_line":"- Adding command to configure trusted mode for VFs"},{"line_number":139,"context_line":"- Updating PCI Request Spec to handle trusted tags"},{"line_number":140,"context_line":"- Configuring trust mode for VFs on libvirt driver."},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"Dependencies"},{"line_number":143,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1f485f77_b2886771","line":140,"updated":"2017-11-10 15:42:16.000000000","message":"Are there changes required on the neutron side in the sriov agent? Are there operations that the neutron SR-IOV agent might perform that might \"break\" VFs once they\u0027ve been consumed by the guest?","commit_id":"bc2572adccdf3cf2a77b50a3b58f71781a4067ce"},{"author":{"_account_id":7730,"name":"Sahid Orentino Ferdjaoui","email":"sahid.ferdjaoui@industrialdiscipline.com","username":"sahid"},"change_message_id":"c5532cbe4e516742f5f4c622ee17e71b3efca644","unresolved":false,"context_lines":[{"line_number":137,"context_line":""},{"line_number":138,"context_line":"- Adding command to configure trusted mode for VFs"},{"line_number":139,"context_line":"- Updating PCI Request Spec to handle trusted tags"},{"line_number":140,"context_line":"- Configuring trust mode for VFs on libvirt driver."},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"Dependencies"},{"line_number":143,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1f485f77_120ff689","line":140,"in_reply_to":"1f485f77_b2886771","updated":"2017-11-14 15:37:23.000000000","message":"No, nothing in neutron side, that will be implemented on nova/os-vif","commit_id":"bc2572adccdf3cf2a77b50a3b58f71781a4067ce"}],"specs/rocky/approved/sriov-trusted-vfs.rst":[{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"9a56fd816817bf62ba12a7e2e546ca206194ce26","unresolved":false,"context_lines":[{"line_number":29,"context_line":"operations, such as enabling multicast promiscuous mode and modifying"},{"line_number":30,"context_line":"the VFs MAC address in the guest. These security measures are designed"},{"line_number":31,"context_line":"to prevent possible attacks, however, in some cases these operations"},{"line_number":32,"context_line":"performed by a VF would be legitimate. Openstack currently doesn\u0027t"},{"line_number":33,"context_line":"provide an easy way for a user to boot an instance with selected"},{"line_number":34,"context_line":"trusted VFs. As well as there is no easy way for cloud operators to"},{"line_number":35,"context_line":"specify which PFs allows its VFs to become trusted."}],"source_content_type":"text/x-rst","patch_set":8,"id":"df7087c5_d3d19959","line":32,"range":{"start_line":32,"start_character":39,"end_line":32,"end_character":48},"updated":"2018-03-07 20:10:42.000000000","message":"OpenStack","commit_id":"3f81742013d969483422d8534438e0769b3df0bd"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"a499975509d01e1c7edfdcfc632b93a59456b5f4","unresolved":false,"context_lines":[{"line_number":30,"context_line":"the VFs MAC address in the guest. These security measures are designed"},{"line_number":31,"context_line":"to prevent possible attacks, however, in some cases these operations"},{"line_number":32,"context_line":"performed by a VF would be legitimate. Openstack currently doesn\u0027t"},{"line_number":33,"context_line":"provide an easy way for a user to boot an instance with selected"},{"line_number":34,"context_line":"trusted VFs. As well as there is no easy way for cloud operators to"},{"line_number":35,"context_line":"specify which PFs allows its VFs to become trusted."},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"Use Cases"}],"source_content_type":"text/x-rst","patch_set":8,"id":"df7087c5_c30d3138","line":34,"range":{"start_line":33,"start_character":0,"end_line":34,"end_character":10},"updated":"2018-03-08 15:15:47.000000000","message":"it would be accurate to say \"provide an easy way for a user to boot an instance that uses trusted VFs\". The word \"selected\" makes it seem like the ideal solution is to have the \"user\" (NFV MANO system) pre-select specific VFs on which to place the instance. This is the opposite of what we want the user to do; instead, we want the user to simply describe to nova/neutron what functionality and resources they need and let the scheduler/placement service decide *which* PF/VFs the instance will be assigned.","commit_id":"3f81742013d969483422d8534438e0769b3df0bd"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"9a56fd816817bf62ba12a7e2e546ca206194ce26","unresolved":false,"context_lines":[{"line_number":45,"context_line":"participating VFs should be trusted in order to successfully configure"},{"line_number":46,"context_line":"bonding in the guest. [1]_"},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"Proposed change"},{"line_number":49,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"The aim of this proposal is to provide way for users to boot instances"}],"source_content_type":"text/x-rst","patch_set":8,"id":"df7087c5_a62ce147","line":48,"updated":"2018-03-07 20:10:42.000000000","message":"This doesn\u0027t really tell me what changes are actually needed on the nova side. This basically says operators will have extra specs for trusted VFs tied to host aggregates, and neutron ports will have to be created with the trusted\u003dTrue attribute, but what happens on the nova side? Nothing?\n\nIf a user comes to nova with a pre-create neutron port that indicates it uses/requires trusted VFs, how are we going to link that up to the request during scheduling to find a host that matches that request?","commit_id":"3f81742013d969483422d8534438e0769b3df0bd"},{"author":{"_account_id":7730,"name":"Sahid Orentino Ferdjaoui","email":"sahid.ferdjaoui@industrialdiscipline.com","username":"sahid"},"change_message_id":"c00ff7a4f28d9053dd94b9ae3afd24d843e4fdf0","unresolved":false,"context_lines":[{"line_number":45,"context_line":"participating VFs should be trusted in order to successfully configure"},{"line_number":46,"context_line":"bonding in the guest. [1]_"},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"Proposed change"},{"line_number":49,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"The aim of this proposal is to provide way for users to boot instances"}],"source_content_type":"text/x-rst","patch_set":8,"id":"df7087c5_48e37e34","line":48,"in_reply_to":"df7087c5_261e91ba","updated":"2018-03-08 14:48:10.000000000","message":"\u003e What does that have to do with extra specs or host aggregates? Why does nova have to configure the VF on the host?\n\nIt seems that you don\u0027t want update the `pci_passthrough_whitelist` option which would have allow to let operators specify which devices can be \"trusted\" or not. The operators will have to isolate hosts with devices that are considered to be trusted (basically on a host we can have all the devices trusted or not).\n\n\u003e Also not sure if we\u0027d want something external changing the VFs to trusted or if that\u0027s something nova (really os-vif) should be doing on the host.\n\nos-vif does not handle this kind of vif (SRIOV VF/PF). Basically that could be done by the sriov_agent running for Neutron or by Nova itself. I choice Nova since it\u0027s related to the kernel and it would avoid to have something like a cross spec between Neutron Novaa. At some point we can imagine migrate SRIOV to os-vif and so it will take care of that.\n\nI guess you probably prefer the sriov_agent to take care of tweaking that part?","commit_id":"3f81742013d969483422d8534438e0769b3df0bd"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"62b06528e3c3a66185ff54ff8cf450dc8ae028ea","unresolved":false,"context_lines":[{"line_number":45,"context_line":"participating VFs should be trusted in order to successfully configure"},{"line_number":46,"context_line":"bonding in the guest. [1]_"},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"Proposed change"},{"line_number":49,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"The aim of this proposal is to provide way for users to boot instances"}],"source_content_type":"text/x-rst","patch_set":8,"id":"df7087c5_6621e9b4","line":48,"in_reply_to":"df7087c5_261e91ba","updated":"2018-03-07 20:37:44.000000000","message":"For the scheduling part, I missed the fact that the trusted attribute gets put on the pci request spec in nova-api, and then the PciPassthroughFilter must be used to link a given host aggregate for that pci request, right?\n\nDoes this go through PciPassthroughFilter - if so, then host aggregates don\u0027t really have anything to do with it do they since that filter doesn\u0027t look for aggregates. I\u0027m confused.\n\nDoes the compute service put something into the host\u0027s pci_stats for the PciPassthroughFilter to use?\n\nThe spec really needs to go through the scheduling details.","commit_id":"3f81742013d969483422d8534438e0769b3df0bd"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"4e5e6ef863ac54d784a8bbdfab2aabca708c0550","unresolved":false,"context_lines":[{"line_number":45,"context_line":"participating VFs should be trusted in order to successfully configure"},{"line_number":46,"context_line":"bonding in the guest. [1]_"},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"Proposed change"},{"line_number":49,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"The aim of this proposal is to provide way for users to boot instances"}],"source_content_type":"text/x-rst","patch_set":8,"id":"df7087c5_522b0c2f","line":48,"in_reply_to":"df7087c5_48e37e34","updated":"2018-03-09 21:38:56.000000000","message":"\u003e I guess you probably prefer the sriov_agent to take care of tweaking that part?\n\nIt doesn\u0027t really matter to me all that much, if it\u0027s simpler to do it in nova then fine.","commit_id":"3f81742013d969483422d8534438e0769b3df0bd"},{"author":{"_account_id":7730,"name":"Sahid Orentino Ferdjaoui","email":"sahid.ferdjaoui@industrialdiscipline.com","username":"sahid"},"change_message_id":"c00ff7a4f28d9053dd94b9ae3afd24d843e4fdf0","unresolved":false,"context_lines":[{"line_number":45,"context_line":"participating VFs should be trusted in order to successfully configure"},{"line_number":46,"context_line":"bonding in the guest. [1]_"},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"Proposed change"},{"line_number":49,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"The aim of this proposal is to provide way for users to boot instances"}],"source_content_type":"text/x-rst","patch_set":8,"id":"df7087c5_684a0228","line":48,"in_reply_to":"df7087c5_6621e9b4","updated":"2018-03-08 14:48:10.000000000","message":"It\u0027s all about tags. The PciPassthroughFilter is reading tags passed by the binding profile. The point is to allow that new tag \"trusted\".","commit_id":"3f81742013d969483422d8534438e0769b3df0bd"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"4e5e6ef863ac54d784a8bbdfab2aabca708c0550","unresolved":false,"context_lines":[{"line_number":45,"context_line":"participating VFs should be trusted in order to successfully configure"},{"line_number":46,"context_line":"bonding in the guest. [1]_"},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"Proposed change"},{"line_number":49,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"The aim of this proposal is to provide way for users to boot instances"}],"source_content_type":"text/x-rst","patch_set":8,"id":"df7087c5_32dd3842","line":48,"in_reply_to":"df7087c5_684a0228","updated":"2018-03-09 21:38:56.000000000","message":"OK in general can you please flesh out the scheduling details in this section and how everything gets linked up?","commit_id":"3f81742013d969483422d8534438e0769b3df0bd"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"0e9e3e461826c991c79b373ad2e8314637a12ca8","unresolved":false,"context_lines":[{"line_number":45,"context_line":"participating VFs should be trusted in order to successfully configure"},{"line_number":46,"context_line":"bonding in the guest. [1]_"},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"Proposed change"},{"line_number":49,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"The aim of this proposal is to provide way for users to boot instances"}],"source_content_type":"text/x-rst","patch_set":8,"id":"df7087c5_261e91ba","line":48,"in_reply_to":"df7087c5_a62ce147","updated":"2018-03-07 20:25:45.000000000","message":"After looking at the proposed code changes, I think what this is essentially proposing is:\n\n1. Create trusted port in neutron.\n2. Nova reads the trusted value of the port binding profile and shoves that into the PCI request spec.\n3. The libvirt driver reads the trusted value off the PCI request spec and shells out to the host to configure the VF as trusted.\n\nWhat does that have to do with extra specs or host aggregates? Why does nova have to configure the VF on the host?\n\nIdeally, what we\u0027d have is VFs modeled as inventory in Placement (via a PF resource provider) and the resource provider in placement would have a \u0027trusted_vf\u0027 trait or something on it. Then during scheduling, we\u0027d have a filter that takes the information from the port (the trusted attribute in the binding profile) and translates that to a required trait, and then the scheduler would ask placement for all hosts that can support trusted VFs (via linking this all together with traits).\n\nThe questions about using placement would be what creates the PF resource provider, who reports VF inventory (nova virt driver or neutron agent?), and who reports the traits on the VFs.\n\nAlso not sure if we\u0027d want something external changing the VFs to trusted or if that\u0027s something nova (really os-vif) should be doing on the host.","commit_id":"3f81742013d969483422d8534438e0769b3df0bd"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"9a56fd816817bf62ba12a7e2e546ca206194ce26","unresolved":false,"context_lines":[{"line_number":48,"context_line":"Proposed change"},{"line_number":49,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"The aim of this proposal is to provide way for users to boot instances"},{"line_number":52,"context_line":"with as assigned SR-IOV VFs which will be configured as trusted. Cloud"},{"line_number":53,"context_line":"operators would have to isolate hosts which provide devices allowed to"},{"line_number":54,"context_line":"be configured as trusted. (see: aggregate_instance_extra_specs"}],"source_content_type":"text/x-rst","patch_set":8,"id":"df7087c5_93cb21a4","line":51,"range":{"start_line":51,"start_character":39,"end_line":51,"end_character":42},"updated":"2018-03-07 20:10:42.000000000","message":"a way","commit_id":"3f81742013d969483422d8534438e0769b3df0bd"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"9a56fd816817bf62ba12a7e2e546ca206194ce26","unresolved":false,"context_lines":[{"line_number":49,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"The aim of this proposal is to provide way for users to boot instances"},{"line_number":52,"context_line":"with as assigned SR-IOV VFs which will be configured as trusted. Cloud"},{"line_number":53,"context_line":"operators would have to isolate hosts which provide devices allowed to"},{"line_number":54,"context_line":"be configured as trusted. (see: aggregate_instance_extra_specs"},{"line_number":55,"context_line":"filter)."}],"source_content_type":"text/x-rst","patch_set":8,"id":"df7087c5_53c5898d","line":52,"range":{"start_line":52,"start_character":5,"end_line":52,"end_character":7},"updated":"2018-03-07 20:10:42.000000000","message":"s/as// ?","commit_id":"3f81742013d969483422d8534438e0769b3df0bd"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"9a56fd816817bf62ba12a7e2e546ca206194ce26","unresolved":false,"context_lines":[{"line_number":51,"context_line":"The aim of this proposal is to provide way for users to boot instances"},{"line_number":52,"context_line":"with as assigned SR-IOV VFs which will be configured as trusted. Cloud"},{"line_number":53,"context_line":"operators would have to isolate hosts which provide devices allowed to"},{"line_number":54,"context_line":"be configured as trusted. (see: aggregate_instance_extra_specs"},{"line_number":55,"context_line":"filter)."},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"In Neutron the ports will have to be created with a specific bindings"}],"source_content_type":"text/x-rst","patch_set":8,"id":"df7087c5_9340010a","line":54,"range":{"start_line":54,"start_character":32,"end_line":54,"end_character":62},"updated":"2018-03-07 20:10:42.000000000","message":"Use the actual filter name AggregateInstanceExtraSpecsFilter.","commit_id":"3f81742013d969483422d8534438e0769b3df0bd"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"9a56fd816817bf62ba12a7e2e546ca206194ce26","unresolved":false,"context_lines":[{"line_number":54,"context_line":"be configured as trusted. (see: aggregate_instance_extra_specs"},{"line_number":55,"context_line":"filter)."},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"In Neutron the ports will have to be created with a specific bindings"},{"line_number":58,"context_line":"to request that we want enable trusted feature for the VF allocated."},{"line_number":59,"context_line":""},{"line_number":60,"context_line":".. code::"}],"source_content_type":"text/x-rst","patch_set":8,"id":"df7087c5_f3329da7","line":57,"range":{"start_line":57,"start_character":50,"end_line":57,"end_character":52},"updated":"2018-03-07 20:10:42.000000000","message":"\"with specific bindings\" (plural) or\n\"with a specific binding\" (singular)\n\nSounds like it\u0027s the latter - there is a \u0027trusted\u0027 attribute on the neutron port binding profile.","commit_id":"3f81742013d969483422d8534438e0769b3df0bd"},{"author":{"_account_id":7166,"name":"Sylvain Bauza","email":"sbauza@redhat.com","username":"sbauza"},"change_message_id":"350139063e1c1bcdece652055dfa65428a9e39ff","unresolved":false,"context_lines":[{"line_number":62,"context_line":"    neutron port-create \u003cnet-id\u003e \\"},{"line_number":63,"context_line":"                        --name sriov_port \\"},{"line_number":64,"context_line":"                        --vnic-type direct \\"},{"line_number":65,"context_line":"                        --binding:profile type\u003ddict trusted\u003dtrue"},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"Alternatives"},{"line_number":68,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":8,"id":"df7087c5_9b781df9","line":65,"updated":"2018-03-07 16:23:06.000000000","message":"I guess there will be an os-vif impact, right?","commit_id":"3f81742013d969483422d8534438e0769b3df0bd"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"a499975509d01e1c7edfdcfc632b93a59456b5f4","unresolved":false,"context_lines":[{"line_number":62,"context_line":"    neutron port-create \u003cnet-id\u003e \\"},{"line_number":63,"context_line":"                        --name sriov_port \\"},{"line_number":64,"context_line":"                        --vnic-type direct \\"},{"line_number":65,"context_line":"                        --binding:profile type\u003ddict trusted\u003dtrue"},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"Alternatives"},{"line_number":68,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":8,"id":"df7087c5_037b298c","line":65,"range":{"start_line":65,"start_character":51,"end_line":65,"end_character":64},"updated":"2018-03-08 15:15:47.000000000","message":"instead of adding yet another random tag to the binding profile, can we use Rodolfo\u0027s capabilities:network work and add a new standardized os-traits trait for trusted mode?\n\nhttps://review.openstack.org/#/c/504895/7/specs/queens/approved/enable-sriov-nic-features.rst@128","commit_id":"3f81742013d969483422d8534438e0769b3df0bd"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"4e5e6ef863ac54d784a8bbdfab2aabca708c0550","unresolved":false,"context_lines":[{"line_number":62,"context_line":"    neutron port-create \u003cnet-id\u003e \\"},{"line_number":63,"context_line":"                        --name sriov_port \\"},{"line_number":64,"context_line":"                        --vnic-type direct \\"},{"line_number":65,"context_line":"                        --binding:profile type\u003ddict trusted\u003dtrue"},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"Alternatives"},{"line_number":68,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":8,"id":"df7087c5_b2c94879","line":65,"range":{"start_line":65,"start_character":51,"end_line":65,"end_character":64},"in_reply_to":"df7087c5_037b298c","updated":"2018-03-09 21:38:56.000000000","message":"\u003e can we use Rodolfo\u0027s capabilities:network work and add a new standardized os-traits trait for trusted mode\n\nWe could, but then we add the dependency and Rodolfo\u0027s stuff has been getting deferred for a couple of releases now, I\u0027m assuming because it\u0027s not trivial and has hairy details of it\u0027s own. I know I had a hard time reviewing it when I glanced over the changes.","commit_id":"3f81742013d969483422d8534438e0769b3df0bd"},{"author":{"_account_id":7730,"name":"Sahid Orentino Ferdjaoui","email":"sahid.ferdjaoui@industrialdiscipline.com","username":"sahid"},"change_message_id":"c00ff7a4f28d9053dd94b9ae3afd24d843e4fdf0","unresolved":false,"context_lines":[{"line_number":62,"context_line":"    neutron port-create \u003cnet-id\u003e \\"},{"line_number":63,"context_line":"                        --name sriov_port \\"},{"line_number":64,"context_line":"                        --vnic-type direct \\"},{"line_number":65,"context_line":"                        --binding:profile type\u003ddict trusted\u003dtrue"},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"Alternatives"},{"line_number":68,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":8,"id":"df7087c5_0d1fd86c","line":65,"in_reply_to":"df7087c5_9b781df9","updated":"2018-03-08 14:48:10.000000000","message":"No, nothing in relation with os-vif. os-vif does not handle VNIC_TYPE_DIRECT*.","commit_id":"3f81742013d969483422d8534438e0769b3df0bd"},{"author":{"_account_id":7166,"name":"Sylvain Bauza","email":"sbauza@redhat.com","username":"sbauza"},"change_message_id":"350139063e1c1bcdece652055dfa65428a9e39ff","unresolved":false,"context_lines":[{"line_number":67,"context_line":"Alternatives"},{"line_number":68,"context_line":"------------"},{"line_number":69,"context_line":""},{"line_number":70,"context_line":"The operator will have to manually configure VFs as trust in the"},{"line_number":71,"context_line":"compute nodes."},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"Data model impact"}],"source_content_type":"text/x-rst","patch_set":8,"id":"df7087c5_bb996120","line":70,"range":{"start_line":70,"start_character":13,"end_line":70,"end_character":22},"updated":"2018-03-07 16:23:06.000000000","message":"grammatical nit : since it\u0027s an alternative, using the conditional would be appropriate (\"could have\")","commit_id":"3f81742013d969483422d8534438e0769b3df0bd"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"9a56fd816817bf62ba12a7e2e546ca206194ce26","unresolved":false,"context_lines":[{"line_number":112,"context_line":"Due to some limitations in Nova it\u0027s currently not possible to"},{"line_number":113,"context_line":"distinguish which pool of pci devices are allowed to be"},{"line_number":114,"context_line":"\"trusted\". Operators will have to isolate hosts on aggregates and use"},{"line_number":115,"context_line":"the aggregate_instance_extra_specs filters to force the instances"},{"line_number":116,"context_line":"scheduled of those group of hosts."},{"line_number":117,"context_line":""},{"line_number":118,"context_line":"Developer impact"}],"source_content_type":"text/x-rst","patch_set":8,"id":"df7087c5_534a6927","line":115,"range":{"start_line":115,"start_character":4,"end_line":115,"end_character":42},"updated":"2018-03-07 20:10:42.000000000","message":"AggregateInstanceExtraSpecsFilter","commit_id":"3f81742013d969483422d8534438e0769b3df0bd"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"9a56fd816817bf62ba12a7e2e546ca206194ce26","unresolved":false,"context_lines":[{"line_number":113,"context_line":"distinguish which pool of pci devices are allowed to be"},{"line_number":114,"context_line":"\"trusted\". Operators will have to isolate hosts on aggregates and use"},{"line_number":115,"context_line":"the aggregate_instance_extra_specs filters to force the instances"},{"line_number":116,"context_line":"scheduled of those group of hosts."},{"line_number":117,"context_line":""},{"line_number":118,"context_line":"Developer impact"},{"line_number":119,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":8,"id":"df7087c5_d35f59e3","line":116,"range":{"start_line":116,"start_character":10,"end_line":116,"end_character":12},"updated":"2018-03-07 20:10:42.000000000","message":"to?","commit_id":"3f81742013d969483422d8534438e0769b3df0bd"},{"author":{"_account_id":7166,"name":"Sylvain Bauza","email":"sbauza@redhat.com","username":"sbauza"},"change_message_id":"350139063e1c1bcdece652055dfa65428a9e39ff","unresolved":false,"context_lines":[{"line_number":140,"context_line":"Work Items"},{"line_number":141,"context_line":"----------"},{"line_number":142,"context_line":""},{"line_number":143,"context_line":"- Adding command to configure trusted mode for VFs"},{"line_number":144,"context_line":"- Updating PCI Request Spec to handle trusted tags"},{"line_number":145,"context_line":"- Configuring trust mode for VFs on libvirt driver."},{"line_number":146,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"df7087c5_3b21d1b5","line":143,"updated":"2018-03-07 16:23:06.000000000","message":"could you please clarify if it\u0027s a nova call or a neutron call ? /me is confused.","commit_id":"3f81742013d969483422d8534438e0769b3df0bd"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"9a56fd816817bf62ba12a7e2e546ca206194ce26","unresolved":false,"context_lines":[{"line_number":141,"context_line":"----------"},{"line_number":142,"context_line":""},{"line_number":143,"context_line":"- Adding command to configure trusted mode for VFs"},{"line_number":144,"context_line":"- Updating PCI Request Spec to handle trusted tags"},{"line_number":145,"context_line":"- Configuring trust mode for VFs on libvirt driver."},{"line_number":146,"context_line":""},{"line_number":147,"context_line":"Dependencies"},{"line_number":148,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":8,"id":"df7087c5_06f02dc9","line":145,"range":{"start_line":144,"start_character":2,"end_line":145,"end_character":51},"updated":"2018-03-07 20:10:42.000000000","message":"This should be described in more detail in the proposed change section.","commit_id":"3f81742013d969483422d8534438e0769b3df0bd"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"9a56fd816817bf62ba12a7e2e546ca206194ce26","unresolved":false,"context_lines":[{"line_number":159,"context_line":"Documentation Impact"},{"line_number":160,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":161,"context_line":""},{"line_number":162,"context_line":"Reno note to inform users and operators how to configure that feature."},{"line_number":163,"context_line":""},{"line_number":164,"context_line":"References"},{"line_number":165,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":8,"id":"df7087c5_26c69169","line":162,"range":{"start_line":162,"start_character":0,"end_line":162,"end_character":70},"updated":"2018-03-07 20:10:42.000000000","message":"A release note is not enough, there would need to be new documentation in the compute admin guide:\n\nhttps://docs.openstack.org/nova/latest/admin/\n\nThat would discuss things such as how to create these types of ports, how to link them up using flavor extra specs and host aggregates, what happens (or is required) on the compute host, and the limitations/caveats are (can we migrate these types of instances?), what the security risks are, etc.","commit_id":"3f81742013d969483422d8534438e0769b3df0bd"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"3fbf603aa2c71ab9d6bfef4e0a4c698a14f000c8","unresolved":false,"context_lines":[{"line_number":84,"context_line":""},{"line_number":85,"context_line":"During the scheduling phase the PciPassthroughtFilter is matching tags"},{"line_number":86,"context_line":"from the PCI Requests with tags passed to the"},{"line_number":87,"context_line":"`pci_passtrought_whitelist` that to accept or not the instance to be"},{"line_number":88,"context_line":"booted on host."},{"line_number":89,"context_line":""},{"line_number":90,"context_line":"The virt drivers will have then to read at the binding profile to"}],"source_content_type":"text/x-rst","patch_set":10,"id":"df7087c5_00cf3529","line":87,"range":{"start_line":87,"start_character":28,"end_line":87,"end_character":42},"updated":"2018-03-13 15:26:15.000000000","message":"that are used to determine whether or not the instance is to be booted on a given host?","commit_id":"4617289fccc5357170789e11748655ef81c0e047"},{"author":{"_account_id":7730,"name":"Sahid Orentino Ferdjaoui","email":"sahid.ferdjaoui@industrialdiscipline.com","username":"sahid"},"change_message_id":"5a979c23553b691597d9150ad9a50ed428d5125d","unresolved":false,"context_lines":[{"line_number":84,"context_line":""},{"line_number":85,"context_line":"During the scheduling phase the PciPassthroughtFilter is matching tags"},{"line_number":86,"context_line":"from the PCI Requests with tags passed to the"},{"line_number":87,"context_line":"`pci_passtrought_whitelist` that to accept or not the instance to be"},{"line_number":88,"context_line":"booted on host."},{"line_number":89,"context_line":""},{"line_number":90,"context_line":"The virt drivers will have then to read at the binding profile to"}],"source_content_type":"text/x-rst","patch_set":10,"id":"df7087c5_4333f714","line":87,"range":{"start_line":87,"start_character":28,"end_line":87,"end_character":42},"in_reply_to":"df7087c5_00cf3529","updated":"2018-03-13 16:14:19.000000000","message":"Yes","commit_id":"4617289fccc5357170789e11748655ef81c0e047"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"0fe15e832693c62407d3422f947fc2e3f47d16f6","unresolved":false,"context_lines":[{"line_number":84,"context_line":""},{"line_number":85,"context_line":"During the scheduling phase the PciPassthroughtFilter is matching tags"},{"line_number":86,"context_line":"from the PCI Requests with tags passed to the"},{"line_number":87,"context_line":"`pci_passtrought_whitelist` that to accept or not the instance to be"},{"line_number":88,"context_line":"booted on host."},{"line_number":89,"context_line":""},{"line_number":90,"context_line":"The virt drivers will have then to read at the binding profile to"}],"source_content_type":"text/x-rst","patch_set":10,"id":"df7087c5_4c2efb43","line":87,"range":{"start_line":87,"start_character":28,"end_line":87,"end_character":42},"in_reply_to":"df7087c5_4333f714","updated":"2018-03-21 15:50:02.000000000","message":"Sorry, I meant this as a suggested re-wording for clarity.","commit_id":"4617289fccc5357170789e11748655ef81c0e047"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"3fbf603aa2c71ab9d6bfef4e0a4c698a14f000c8","unresolved":false,"context_lines":[{"line_number":87,"context_line":"`pci_passtrought_whitelist` that to accept or not the instance to be"},{"line_number":88,"context_line":"booted on host."},{"line_number":89,"context_line":""},{"line_number":90,"context_line":"The virt drivers will have then to read at the binding profile to"},{"line_number":91,"context_line":"check whether the VFs should be considered as \"trusted\". When"},{"line_number":92,"context_line":"destroying the instance, it\u0027s responsability of virt drivers to update"},{"line_number":93,"context_line":"the VFs allowed to instance in their default state."}],"source_content_type":"text/x-rst","patch_set":10,"id":"df7087c5_e0d9e1f2","line":90,"range":{"start_line":90,"start_character":40,"end_line":90,"end_character":42},"updated":"2018-03-13 15:26:15.000000000","message":"s/at//","commit_id":"4617289fccc5357170789e11748655ef81c0e047"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"3fbf603aa2c71ab9d6bfef4e0a4c698a14f000c8","unresolved":false,"context_lines":[{"line_number":87,"context_line":"`pci_passtrought_whitelist` that to accept or not the instance to be"},{"line_number":88,"context_line":"booted on host."},{"line_number":89,"context_line":""},{"line_number":90,"context_line":"The virt drivers will have then to read at the binding profile to"},{"line_number":91,"context_line":"check whether the VFs should be considered as \"trusted\". When"},{"line_number":92,"context_line":"destroying the instance, it\u0027s responsability of virt drivers to update"},{"line_number":93,"context_line":"the VFs allowed to instance in their default state."}],"source_content_type":"text/x-rst","patch_set":10,"id":"df7087c5_20d4b9bc","line":90,"range":{"start_line":90,"start_character":22,"end_line":90,"end_character":31},"updated":"2018-03-13 15:26:15.000000000","message":"then have","commit_id":"4617289fccc5357170789e11748655ef81c0e047"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"3fbf603aa2c71ab9d6bfef4e0a4c698a14f000c8","unresolved":false,"context_lines":[{"line_number":89,"context_line":""},{"line_number":90,"context_line":"The virt drivers will have then to read at the binding profile to"},{"line_number":91,"context_line":"check whether the VFs should be considered as \"trusted\". When"},{"line_number":92,"context_line":"destroying the instance, it\u0027s responsability of virt drivers to update"},{"line_number":93,"context_line":"the VFs allowed to instance in their default state."},{"line_number":94,"context_line":""},{"line_number":95,"context_line":"Alternatives"}],"source_content_type":"text/x-rst","patch_set":10,"id":"df7087c5_a0df69d4","line":92,"range":{"start_line":92,"start_character":25,"end_line":92,"end_character":29},"updated":"2018-03-13 15:26:15.000000000","message":"it\u0027s the","commit_id":"4617289fccc5357170789e11748655ef81c0e047"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"1d7fc7ae030030cab8631277ab6faa82f46f3615","unresolved":false,"context_lines":[{"line_number":89,"context_line":""},{"line_number":90,"context_line":"The virt drivers will have then to read at the binding profile to"},{"line_number":91,"context_line":"check whether the VFs should be considered as \"trusted\". When"},{"line_number":92,"context_line":"destroying the instance, it\u0027s responsability of virt drivers to update"},{"line_number":93,"context_line":"the VFs allowed to instance in their default state."},{"line_number":94,"context_line":""},{"line_number":95,"context_line":"Alternatives"}],"source_content_type":"text/x-rst","patch_set":10,"id":"df7087c5_6bf7b25a","line":92,"range":{"start_line":92,"start_character":30,"end_line":92,"end_character":44},"updated":"2018-03-15 14:54:54.000000000","message":"responsibility","commit_id":"4617289fccc5357170789e11748655ef81c0e047"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"3fbf603aa2c71ab9d6bfef4e0a4c698a14f000c8","unresolved":false,"context_lines":[{"line_number":90,"context_line":"The virt drivers will have then to read at the binding profile to"},{"line_number":91,"context_line":"check whether the VFs should be considered as \"trusted\". When"},{"line_number":92,"context_line":"destroying the instance, it\u0027s responsability of virt drivers to update"},{"line_number":93,"context_line":"the VFs allowed to instance in their default state."},{"line_number":94,"context_line":""},{"line_number":95,"context_line":"Alternatives"},{"line_number":96,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":10,"id":"df7087c5_a0f8c948","line":93,"range":{"start_line":93,"start_character":8,"end_line":93,"end_character":27},"updated":"2018-03-13 15:26:15.000000000","message":"I don\u0027t know what \"allowed to instance\" means.\n\nFor the last sentence, does this mean the virt driver might unset the \u0027trusted\u0027 configuration for the PF on the host? How is it going to know if another instance is using a trusted VF in that PF to safely mark the PF as no longer being trusted?","commit_id":"4617289fccc5357170789e11748655ef81c0e047"},{"author":{"_account_id":7730,"name":"Sahid Orentino Ferdjaoui","email":"sahid.ferdjaoui@industrialdiscipline.com","username":"sahid"},"change_message_id":"5a979c23553b691597d9150ad9a50ed428d5125d","unresolved":false,"context_lines":[{"line_number":90,"context_line":"The virt drivers will have then to read at the binding profile to"},{"line_number":91,"context_line":"check whether the VFs should be considered as \"trusted\". When"},{"line_number":92,"context_line":"destroying the instance, it\u0027s responsability of virt drivers to update"},{"line_number":93,"context_line":"the VFs allowed to instance in their default state."},{"line_number":94,"context_line":""},{"line_number":95,"context_line":"Alternatives"},{"line_number":96,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":10,"id":"df7087c5_b699f3c4","line":93,"range":{"start_line":93,"start_character":8,"end_line":93,"end_character":27},"in_reply_to":"df7087c5_a0f8c948","updated":"2018-03-13 16:14:19.000000000","message":"It\u0027s not the PFs which are configured to use trusted mode or not, it\u0027s the VFs [0].\n\nI wanted to specifically add a note so that all virt drivers are using this feature in a same way. If a driver is configuring trusted mode for a VF because an instance is requesting that so when that instance is going to be destroyed we want the driver to remove the trusted mode for that VF.\n\nI will try to rephrase that point.\n\n[0] https://review.openstack.org/#/c/458513/11/nova/network/linux_net.py","commit_id":"4617289fccc5357170789e11748655ef81c0e047"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"1d7fc7ae030030cab8631277ab6faa82f46f3615","unresolved":false,"context_lines":[{"line_number":90,"context_line":"The virt drivers will have then to read at the binding profile to"},{"line_number":91,"context_line":"check whether the VFs should be considered as \"trusted\". When"},{"line_number":92,"context_line":"destroying the instance, it\u0027s responsability of virt drivers to update"},{"line_number":93,"context_line":"the VFs allowed to instance in their default state."},{"line_number":94,"context_line":""},{"line_number":95,"context_line":"Alternatives"},{"line_number":96,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":10,"id":"df7087c5_fe014206","line":93,"range":{"start_line":93,"start_character":8,"end_line":93,"end_character":27},"in_reply_to":"df7087c5_ab4501b6","updated":"2018-03-15 14:54:54.000000000","message":"@mriedem: what we discussed at the PTG was that *either* a PF *or* a VF could be marked with the proposed HW_NIC_SRIOV_TRUSTED trait. If the PF was marked with the trait, then all VFs on the PF would be trusted. If just a single VF needed to be marked as trusted, then a child resource provider for just that VF would need to be created under the PF resource provider, that VF resource provider would be associated with the HW_NIC_SRIOV_TRUSTED trait and it would get an inventory of SRIOV_NET_VF of 1.","commit_id":"4617289fccc5357170789e11748655ef81c0e047"},{"author":{"_account_id":7730,"name":"Sahid Orentino Ferdjaoui","email":"sahid.ferdjaoui@industrialdiscipline.com","username":"sahid"},"change_message_id":"deff06340912f48cc8707691fcd51c0f4ae82b5f","unresolved":false,"context_lines":[{"line_number":90,"context_line":"The virt drivers will have then to read at the binding profile to"},{"line_number":91,"context_line":"check whether the VFs should be considered as \"trusted\". When"},{"line_number":92,"context_line":"destroying the instance, it\u0027s responsability of virt drivers to update"},{"line_number":93,"context_line":"the VFs allowed to instance in their default state."},{"line_number":94,"context_line":""},{"line_number":95,"context_line":"Alternatives"},{"line_number":96,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":10,"id":"df7087c5_d8e7e011","line":93,"range":{"start_line":93,"start_character":8,"end_line":93,"end_character":27},"in_reply_to":"df7087c5_ab4501b6","updated":"2018-03-14 09:02:34.000000000","message":"I could not say it\u0027s all-or-none but there is an important security consideration for operators as noted in the \"security\" section. If a VF is using trusted mode so it will be possible for the guest to enable promiscuous mode, meaning that the VF will receive all multicast traffic that the PF is receiving also the unmatched traffics.\n\nI need to double check something because in the security section we have indicated that the VF can also receive traffics targeted for other VFs which I think it\u0027s false.","commit_id":"4617289fccc5357170789e11748655ef81c0e047"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"4e8d39b347b4ebd98b41d20f1b643cd614ce51ef","unresolved":false,"context_lines":[{"line_number":90,"context_line":"The virt drivers will have then to read at the binding profile to"},{"line_number":91,"context_line":"check whether the VFs should be considered as \"trusted\". When"},{"line_number":92,"context_line":"destroying the instance, it\u0027s responsability of virt drivers to update"},{"line_number":93,"context_line":"the VFs allowed to instance in their default state."},{"line_number":94,"context_line":""},{"line_number":95,"context_line":"Alternatives"},{"line_number":96,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":10,"id":"df7087c5_ab4501b6","line":93,"range":{"start_line":93,"start_character":8,"end_line":93,"end_character":27},"in_reply_to":"df7087c5_b699f3c4","updated":"2018-03-13 21:51:26.000000000","message":"\u003e It\u0027s not the PFs which are configured to use trusted mode or not, it\u0027s the VFs [0].\n\nOK, I was misunderstanding then because when I was talking with artom, dansmith and jaypipes about modeling this in placement, the resource provider would have the \u0027trusted\u0027 trait and in this scenario the PF is the resource provider and the VF is inventory on that provider, so I assumed that all VFs within a PF would be either trusted or not trusted, not some are and some aren\u0027t.\n\nIs there a security implication to having some VFs within a PF be trusted and others aren\u0027t? In other words, should we say that it\u0027s either all-or-none, i.e. if any VF within a PF needs to be trusted, they should all be trusted?","commit_id":"4617289fccc5357170789e11748655ef81c0e047"},{"author":{"_account_id":14070,"name":"Eric Fried","email":"openstack@fried.cc","username":"efried"},"change_message_id":"7c5d801f12a2a6de4f099a669eb427b79a4fdcad","unresolved":false,"context_lines":[{"line_number":90,"context_line":"The virt drivers will have then to read at the binding profile to"},{"line_number":91,"context_line":"check whether the VFs should be considered as \"trusted\". When"},{"line_number":92,"context_line":"destroying the instance, it\u0027s responsability of virt drivers to update"},{"line_number":93,"context_line":"the VFs allowed to instance in their default state."},{"line_number":94,"context_line":""},{"line_number":95,"context_line":"Alternatives"},{"line_number":96,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":10,"id":"df7087c5_12f4d95a","line":93,"range":{"start_line":93,"start_character":8,"end_line":93,"end_character":27},"in_reply_to":"df7087c5_fe014206","updated":"2018-03-19 20:53:49.000000000","message":"How does this splitup-and-trait-marking occur?  Does the virt driver (via update_provider_tree) do it based on processing the [pci]passthrough_whitelist (ew)?  Does an admin do it via osc (ew)?\n\nDoes libvirt spoof a \"capability\" that gets swept up by Rodolfo\u0027s thing (ew)?  If this, where does it get that capability from?\n\nDoes neutron do it when you create the port (ew)?  In which case, we would need to make sure that only properly-authorized users are allowed to create ports with trusted\u003dTrue.","commit_id":"4617289fccc5357170789e11748655ef81c0e047"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"3fbf603aa2c71ab9d6bfef4e0a4c698a14f000c8","unresolved":false,"context_lines":[{"line_number":95,"context_line":"Alternatives"},{"line_number":96,"context_line":"------------"},{"line_number":97,"context_line":""},{"line_number":98,"context_line":"The operator could have to manually configure VFs as trust in the"},{"line_number":99,"context_line":"compute nodes."},{"line_number":100,"context_line":""},{"line_number":101,"context_line":"A long term view would be to use the network capabilities and add new"}],"source_content_type":"text/x-rst","patch_set":10,"id":"df7087c5_40976ded","line":98,"range":{"start_line":98,"start_character":53,"end_line":98,"end_character":58},"updated":"2018-03-13 15:26:15.000000000","message":"trusted","commit_id":"4617289fccc5357170789e11748655ef81c0e047"},{"author":{"_account_id":7730,"name":"Sahid Orentino Ferdjaoui","email":"sahid.ferdjaoui@industrialdiscipline.com","username":"sahid"},"change_message_id":"1819b8e7463d69f44d27258b4ded951cf0f285d9","unresolved":false,"context_lines":[{"line_number":98,"context_line":"The operator could have to manually configure VFs as trust in the"},{"line_number":99,"context_line":"compute nodes."},{"line_number":100,"context_line":""},{"line_number":101,"context_line":"A long term view would be to use the network capabilities and add new"},{"line_number":102,"context_line":"standardized os-starts for trusted mode as well as using the placement"},{"line_number":103,"context_line":"for the scheduling phase."},{"line_number":104,"context_line":""}],"source_content_type":"text/x-rst","patch_set":10,"id":"df7087c5_9f60b203","line":101,"updated":"2018-03-12 10:07:23.000000000","message":"Jay, if you can give me more details I could update this part.","commit_id":"4617289fccc5357170789e11748655ef81c0e047"},{"author":{"_account_id":7730,"name":"Sahid Orentino Ferdjaoui","email":"sahid.ferdjaoui@industrialdiscipline.com","username":"sahid"},"change_message_id":"5a979c23553b691597d9150ad9a50ed428d5125d","unresolved":false,"context_lines":[{"line_number":98,"context_line":"The operator could have to manually configure VFs as trust in the"},{"line_number":99,"context_line":"compute nodes."},{"line_number":100,"context_line":""},{"line_number":101,"context_line":"A long term view would be to use the network capabilities and add new"},{"line_number":102,"context_line":"standardized os-starts for trusted mode as well as using the placement"},{"line_number":103,"context_line":"for the scheduling phase."},{"line_number":104,"context_line":""}],"source_content_type":"text/x-rst","patch_set":10,"id":"df7087c5_165d3fe8","line":101,"in_reply_to":"df7087c5_00b6558b","updated":"2018-03-13 16:14:19.000000000","message":"Ok thanks I will try to summarize and update that point.","commit_id":"4617289fccc5357170789e11748655ef81c0e047"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"3fbf603aa2c71ab9d6bfef4e0a4c698a14f000c8","unresolved":false,"context_lines":[{"line_number":98,"context_line":"The operator could have to manually configure VFs as trust in the"},{"line_number":99,"context_line":"compute nodes."},{"line_number":100,"context_line":""},{"line_number":101,"context_line":"A long term view would be to use the network capabilities and add new"},{"line_number":102,"context_line":"standardized os-starts for trusted mode as well as using the placement"},{"line_number":103,"context_line":"for the scheduling phase."},{"line_number":104,"context_line":""}],"source_content_type":"text/x-rst","patch_set":10,"id":"df7087c5_00b6558b","line":101,"in_reply_to":"df7087c5_9f60b203","updated":"2018-03-13 15:26:15.000000000","message":"I think the point is that in the future, we could build on the work from blueprint enable-sriov-nic-features where we standardize nic features as standard traits, defined in the os-traits library, and we can put a \u0027TRUSTED\u0027 trait on a resource provider representing a PF. Then during scheduling, we\u0027d write a placement request filter [1] which translates the \u0027trusted\u0027 value from the port binding profile into a placement request saying, \"I need a host with PFs that are marked as trusted.\" Then we don\u0027t need the pci passthrough_whitelist config option of the PciPassthroughFilter.\n\nI mentioned this earlier in PS8:\n\n\u003e Ideally, what we\u0027d have is VFs modeled as inventory in Placement (via a PF resource provider) and the resource provider in placement would have a \u0027trusted_vf\u0027 trait or something on it. Then during scheduling, we\u0027d have a filter that takes the information from the port (the trusted attribute in the binding profile) and translates that to a required trait, and then the scheduler would ask placement for all hosts that can support trusted VFs (via linking this all together with traits).\n\u003e The questions about using placement would be what creates the PF resource provider, who reports VF inventory (nova virt driver or neutron agent?), and who reports the traits on the VFs.\n\nI think that\u0027s what we want long-term but the pieces are not all there yet and to make this spec dependent on them would mean this feature likely isn\u0027t available, in any form, in the Rocky release.\n\n[1] https://specs.openstack.org/openstack/nova-specs/specs/rocky/approved/placement-req-filter.html","commit_id":"4617289fccc5357170789e11748655ef81c0e047"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"3fbf603aa2c71ab9d6bfef4e0a4c698a14f000c8","unresolved":false,"context_lines":[{"line_number":99,"context_line":"compute nodes."},{"line_number":100,"context_line":""},{"line_number":101,"context_line":"A long term view would be to use the network capabilities and add new"},{"line_number":102,"context_line":"standardized os-starts for trusted mode as well as using the placement"},{"line_number":103,"context_line":"for the scheduling phase."},{"line_number":104,"context_line":""},{"line_number":105,"context_line":"Data model impact"}],"source_content_type":"text/x-rst","patch_set":10,"id":"df7087c5_009df508","line":102,"range":{"start_line":102,"start_character":16,"end_line":102,"end_character":22},"updated":"2018-03-13 15:26:15.000000000","message":"os-traits","commit_id":"4617289fccc5357170789e11748655ef81c0e047"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"1d7fc7ae030030cab8631277ab6faa82f46f3615","unresolved":false,"context_lines":[{"line_number":99,"context_line":"compute nodes."},{"line_number":100,"context_line":""},{"line_number":101,"context_line":"A long term view would be to use the network capabilities and add new"},{"line_number":102,"context_line":"standardized os-starts for trusted mode as well as using the placement"},{"line_number":103,"context_line":"for the scheduling phase."},{"line_number":104,"context_line":""},{"line_number":105,"context_line":"Data model impact"}],"source_content_type":"text/x-rst","patch_set":10,"id":"df7087c5_1e2e7691","line":102,"range":{"start_line":102,"start_character":16,"end_line":102,"end_character":22},"in_reply_to":"df7087c5_009df508","updated":"2018-03-15 14:54:54.000000000","message":"right, and that trait has been proposed already:\n\nhttps://review.openstack.org/#/c/550873/\n\njust waiting to pass the gate...","commit_id":"4617289fccc5357170789e11748655ef81c0e047"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"3fbf603aa2c71ab9d6bfef4e0a4c698a14f000c8","unresolved":false,"context_lines":[{"line_number":187,"context_line":"Documentation Impact"},{"line_number":188,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":189,"context_line":""},{"line_number":190,"context_line":"Reno note to inform users and operators how to configure that feature."},{"line_number":191,"context_line":""},{"line_number":192,"context_line":"References"},{"line_number":193,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":10,"id":"df7087c5_c00ffd34","line":190,"updated":"2018-03-13 15:26:15.000000000","message":"Re-stating from PS8:\n\n\u003e A release note is not enough, there would need to be new documentation in the compute admin guide: https://docs.openstack.org/nova/latest/admin/\nThat would discuss things such as how to create these types of ports, how to link them up using flavor extra specs and host aggregates, what happens (or is required) on the compute host, and the limitations/caveats are (can we migrate these types of instances?), what the security risks are, etc.","commit_id":"4617289fccc5357170789e11748655ef81c0e047"},{"author":{"_account_id":7730,"name":"Sahid Orentino Ferdjaoui","email":"sahid.ferdjaoui@industrialdiscipline.com","username":"sahid"},"change_message_id":"5a979c23553b691597d9150ad9a50ed428d5125d","unresolved":false,"context_lines":[{"line_number":187,"context_line":"Documentation Impact"},{"line_number":188,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":189,"context_line":""},{"line_number":190,"context_line":"Reno note to inform users and operators how to configure that feature."},{"line_number":191,"context_line":""},{"line_number":192,"context_line":"References"},{"line_number":193,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":10,"id":"df7087c5_b64c9342","line":190,"in_reply_to":"df7087c5_c00ffd34","updated":"2018-03-13 16:14:19.000000000","message":"I missed that point. I will update it.","commit_id":"4617289fccc5357170789e11748655ef81c0e047"},{"author":{"_account_id":14070,"name":"Eric Fried","email":"openstack@fried.cc","username":"efried"},"change_message_id":"7c5d801f12a2a6de4f099a669eb427b79a4fdcad","unresolved":false,"context_lines":[{"line_number":27,"context_line":""},{"line_number":28,"context_line":"By default, Virtual Functions have no privileges to perform certain"},{"line_number":29,"context_line":"operations, such as enabling multicast promiscuous mode and modifying"},{"line_number":30,"context_line":"the VFs MAC address in the guest. These security measures are designed"},{"line_number":31,"context_line":"to prevent possible attacks, however, in some cases these operations"},{"line_number":32,"context_line":"performed by a VF would be legitimate. OpenStack currently doesn\u0027t"},{"line_number":33,"context_line":"provide an easy way for a user to boot an instance that uses trusted"}],"source_content_type":"text/x-rst","patch_set":11,"id":"df7087c5_177febab","line":30,"range":{"start_line":30,"start_character":4,"end_line":30,"end_character":7},"updated":"2018-03-19 20:53:49.000000000","message":"VF\u0027s","commit_id":"607904113e9761b942e08776ad4fe38f3061cf4b"},{"author":{"_account_id":14070,"name":"Eric Fried","email":"openstack@fried.cc","username":"efried"},"change_message_id":"7c5d801f12a2a6de4f099a669eb427b79a4fdcad","unresolved":false,"context_lines":[{"line_number":32,"context_line":"performed by a VF would be legitimate. OpenStack currently doesn\u0027t"},{"line_number":33,"context_line":"provide an easy way for a user to boot an instance that uses trusted"},{"line_number":34,"context_line":"VFs. As well as there is no easy way for cloud operators to specify"},{"line_number":35,"context_line":"which PFs allows its VFs to become trusted."},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"Use Cases"},{"line_number":38,"context_line":"---------"}],"source_content_type":"text/x-rst","patch_set":11,"id":"df7087c5_37554f1e","line":35,"range":{"start_line":35,"start_character":10,"end_line":35,"end_character":20},"updated":"2018-03-19 20:53:49.000000000","message":"allow their","commit_id":"607904113e9761b942e08776ad4fe38f3061cf4b"},{"author":{"_account_id":14070,"name":"Eric Fried","email":"openstack@fried.cc","username":"efried"},"change_message_id":"7c5d801f12a2a6de4f099a669eb427b79a4fdcad","unresolved":false,"context_lines":[{"line_number":62,"context_line":"   [pci]"},{"line_number":63,"context_line":"   passthrough_whitelist \u003d {\"devname\": \"eth0\","},{"line_number":64,"context_line":"                            \"physical_network\": \"phy0\","},{"line_number":65,"context_line":"                            \"trusted\": \"true\"}"},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"In Neutron the ports will have to be created with a specific bindings"},{"line_number":68,"context_line":"to request that we want enable trusted feature for the VF allocated."}],"source_content_type":"text/x-rst","patch_set":11,"id":"df7087c5_97121b62","line":65,"range":{"start_line":65,"start_character":28,"end_line":65,"end_character":45},"updated":"2018-03-19 20:53:49.000000000","message":"Yet another overload of the whitelist - ugh.","commit_id":"607904113e9761b942e08776ad4fe38f3061cf4b"},{"author":{"_account_id":14070,"name":"Eric Fried","email":"openstack@fried.cc","username":"efried"},"change_message_id":"7c5d801f12a2a6de4f099a669eb427b79a4fdcad","unresolved":false,"context_lines":[{"line_number":79,"context_line":"the requests specs and tags for pools."},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"An instance requesting to boot with SRIOV VFs attached will have PCI"},{"line_number":82,"context_line":"requests assigned. For ports attached to instance that are requesting"},{"line_number":83,"context_line":"\"trusted\", the PCI requests will be enhanced by a tag \"trusted\"."},{"line_number":84,"context_line":""},{"line_number":85,"context_line":"During the scheduling phase the PciPassthroughtFilter is matching tags"}],"source_content_type":"text/x-rst","patch_set":11,"id":"df7087c5_37030f12","line":82,"range":{"start_line":82,"start_character":41,"end_line":82,"end_character":49},"updated":"2018-03-19 20:53:49.000000000","message":"instances","commit_id":"607904113e9761b942e08776ad4fe38f3061cf4b"},{"author":{"_account_id":14070,"name":"Eric Fried","email":"openstack@fried.cc","username":"efried"},"change_message_id":"7c5d801f12a2a6de4f099a669eb427b79a4fdcad","unresolved":false,"context_lines":[{"line_number":84,"context_line":""},{"line_number":85,"context_line":"During the scheduling phase the PciPassthroughtFilter is matching tags"},{"line_number":86,"context_line":"from the PCI Requests with tags passed to the"},{"line_number":87,"context_line":"`pci_passtrought_whitelist` that to accept or not the instance to be"},{"line_number":88,"context_line":"booted on host."},{"line_number":89,"context_line":""},{"line_number":90,"context_line":"The virt drivers will then have to read the binding profile to check"}],"source_content_type":"text/x-rst","patch_set":11,"id":"df7087c5_52181174","line":87,"range":{"start_line":87,"start_character":28,"end_line":87,"end_character":49},"updated":"2018-03-19 20:53:49.000000000","message":"?","commit_id":"607904113e9761b942e08776ad4fe38f3061cf4b"},{"author":{"_account_id":14070,"name":"Eric Fried","email":"openstack@fried.cc","username":"efried"},"change_message_id":"7c5d801f12a2a6de4f099a669eb427b79a4fdcad","unresolved":false,"context_lines":[{"line_number":90,"context_line":"The virt drivers will then have to read the binding profile to check"},{"line_number":91,"context_line":"whether the VFs assigned for an instance should have their trusted"},{"line_number":92,"context_line":"mode activated. When destroying the instance, it\u0027s responsibility of"},{"line_number":93,"context_line":"virt drivers to update the VFs which have been assigned to instance in"},{"line_number":94,"context_line":"their default state (trusted mode off)."},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"Alternatives"}],"source_content_type":"text/x-rst","patch_set":11,"id":"df7087c5_923789e4","line":93,"range":{"start_line":93,"start_character":59,"end_line":93,"end_character":67},"updated":"2018-03-19 20:53:49.000000000","message":"instances","commit_id":"607904113e9761b942e08776ad4fe38f3061cf4b"},{"author":{"_account_id":14070,"name":"Eric Fried","email":"openstack@fried.cc","username":"efried"},"change_message_id":"7c5d801f12a2a6de4f099a669eb427b79a4fdcad","unresolved":false,"context_lines":[{"line_number":176,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":177,"context_line":""},{"line_number":178,"context_line":"Even if not directly related the spec User-controlled SR-IOV ports"},{"line_number":179,"context_line":"allocation\" [4]_ would provide required granularity in an use-case"},{"line_number":180,"context_line":"like \"fail-over bonding\" to connect NICs on different physical switch."},{"line_number":181,"context_line":""},{"line_number":182,"context_line":"Testing"}],"source_content_type":"text/x-rst","patch_set":11,"id":"df7087c5_923c69c0","line":179,"range":{"start_line":179,"start_character":10,"end_line":179,"end_character":11},"updated":"2018-03-19 20:53:49.000000000","message":"mismatched","commit_id":"607904113e9761b942e08776ad4fe38f3061cf4b"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"0fe15e832693c62407d3422f947fc2e3f47d16f6","unresolved":false,"context_lines":[{"line_number":38,"context_line":"---------"},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"There are several use cases in which users would prefer to take"},{"line_number":41,"context_line":"advantage of the trusted VFs. Bonding VFs in a guest would be one of"},{"line_number":42,"context_line":"these. Bonding modes that require all slaves to use the same MAC"},{"line_number":43,"context_line":"address, would require address modification on one of the VFs during a"},{"line_number":44,"context_line":"fail-over. As MAC address altering is a privileged operation,"},{"line_number":45,"context_line":"participating VFs should be trusted in order to successfully configure"},{"line_number":46,"context_line":"bonding in the guest. [1]_"},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"Proposed change"},{"line_number":49,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":12,"id":"df7087c5_1709f02a","line":46,"range":{"start_line":41,"start_character":30,"end_line":46,"end_character":26},"updated":"2018-03-21 15:50:02.000000000","message":"Sort of sounds like volume multiattach with the \"shareable\" element in the libvirt disk config xml.","commit_id":"fb87957f1ca2d7e23af4c8266d1aba906485f98d"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"0fe15e832693c62407d3422f947fc2e3f47d16f6","unresolved":false,"context_lines":[{"line_number":84,"context_line":""},{"line_number":85,"context_line":"During the scheduling phase the PciPassthroughtFilter is matching tags"},{"line_number":86,"context_line":"from the PCI Requests with tags passed to the"},{"line_number":87,"context_line":"`pci_passtrought_whitelist` that to accept or not instance to be"},{"line_number":88,"context_line":"booted on host."},{"line_number":89,"context_line":""},{"line_number":90,"context_line":"The virt drivers will then have to read the binding profile to check"},{"line_number":91,"context_line":"whether the VFs assigned for an instance should have their trusted"}],"source_content_type":"text/x-rst","patch_set":12,"id":"df7087c5_ac16b7f0","line":88,"range":{"start_line":87,"start_character":28,"end_line":88,"end_character":15},"updated":"2018-03-21 15:50:02.000000000","message":"Suggest re-wording this with:\n\n\"that are used to determine whether or not the instance is to be booted on a given host.\"","commit_id":"fb87957f1ca2d7e23af4c8266d1aba906485f98d"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"0fe15e832693c62407d3422f947fc2e3f47d16f6","unresolved":false,"context_lines":[{"line_number":89,"context_line":""},{"line_number":90,"context_line":"The virt drivers will then have to read the binding profile to check"},{"line_number":91,"context_line":"whether the VFs assigned for an instance should have their trusted"},{"line_number":92,"context_line":"mode activated. When destroying the instance, it\u0027s responsibility of"},{"line_number":93,"context_line":"virt drivers to update the VFs which have been assigned to instances"},{"line_number":94,"context_line":"in their default state (trusted mode off)."},{"line_number":95,"context_line":""}],"source_content_type":"text/x-rst","patch_set":12,"id":"df7087c5_acf8f748","line":92,"range":{"start_line":92,"start_character":46,"end_line":92,"end_character":50},"updated":"2018-03-21 15:50:02.000000000","message":"nit: \"it\u0027s the\"","commit_id":"fb87957f1ca2d7e23af4c8266d1aba906485f98d"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"0fe15e832693c62407d3422f947fc2e3f47d16f6","unresolved":false,"context_lines":[{"line_number":101,"context_line":""},{"line_number":102,"context_line":"A long term view would be to use the network capabilities and add new"},{"line_number":103,"context_line":"standardized os-traits for trusted mode as well as using the placement"},{"line_number":104,"context_line":"for the scheduling phase, they are some work on-progress [6]_ [7]_."},{"line_number":105,"context_line":""},{"line_number":106,"context_line":"Data model impact"},{"line_number":107,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":12,"id":"df7087c5_ec5a6f4e","line":104,"range":{"start_line":104,"start_character":45,"end_line":104,"end_character":47},"updated":"2018-03-21 15:50:02.000000000","message":"in-progress","commit_id":"fb87957f1ca2d7e23af4c8266d1aba906485f98d"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"0fe15e832693c62407d3422f947fc2e3f47d16f6","unresolved":false,"context_lines":[{"line_number":111,"context_line":"REST API impact"},{"line_number":112,"context_line":"---------------"},{"line_number":113,"context_line":""},{"line_number":114,"context_line":"N/A"},{"line_number":115,"context_line":""},{"line_number":116,"context_line":"Security impact"},{"line_number":117,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":12,"id":"df7087c5_9791809c","line":114,"updated":"2018-03-21 15:50:02.000000000","message":"Thinking about the config drive and metadata service, is there something that needs to be added so that the guest will be able to tell if the VFs are trusted?\n\nOr is that already possible with device tags, i.e. the SR-IOV port with the \u0027trusted\u0027 binding profile flag would be passed to nova to create the server and the user would need to specify a tag in the request which then gets put into the guest via config drive or metadata service. If so, then we should be sure to include this in the user documentation of the feature.","commit_id":"fb87957f1ca2d7e23af4c8266d1aba906485f98d"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"0fe15e832693c62407d3422f947fc2e3f47d16f6","unresolved":false,"context_lines":[{"line_number":131,"context_line":"---------------------"},{"line_number":132,"context_line":""},{"line_number":133,"context_line":"Users which request their NICs as \u0027trusted\u0027 during boot time will have"},{"line_number":134,"context_line":"the ability to change the MAC addresses of the VFs"},{"line_number":135,"context_line":""},{"line_number":136,"context_line":"Performance Impact"},{"line_number":137,"context_line":"------------------"}],"source_content_type":"text/x-rst","patch_set":12,"id":"df7087c5_b75e0410","line":134,"range":{"start_line":134,"start_character":15,"end_line":134,"end_character":50},"updated":"2018-03-21 15:50:02.000000000","message":"Suggest adding, \"change the MAC addresses of the VFs within the guest VM.\" Just to complete that thought.","commit_id":"fb87957f1ca2d7e23af4c8266d1aba906485f98d"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"7d8533a07ca72313fab93d5d3d95fb223231b932","unresolved":false,"context_lines":[{"line_number":101,"context_line":""},{"line_number":102,"context_line":"A long term view would be to use the network capabilities and add new"},{"line_number":103,"context_line":"standardized os-traits for trusted mode as well as using the placement"},{"line_number":104,"context_line":"for the scheduling phase, they are some work on-progress [6]_ [7]_."},{"line_number":105,"context_line":""},{"line_number":106,"context_line":"Data model impact"},{"line_number":107,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":14,"id":"df7087c5_26a7ffbf","line":104,"range":{"start_line":104,"start_character":45,"end_line":104,"end_character":56},"updated":"2018-03-22 19:04:54.000000000","message":"in-progress","commit_id":"430262b013eef7969c2910d6fa569bec7161741a"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"7d8533a07ca72313fab93d5d3d95fb223231b932","unresolved":false,"context_lines":[{"line_number":107,"context_line":"-----------------"},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"A new attribute \u0027vf_trusted\u0027 will be add to object"},{"line_number":110,"context_line":"`NetworkInterfaceMetadata` This attribute will be set only if the"},{"line_number":111,"context_line":"interface is type SRIOV VF and will indicate whether the VF is using"},{"line_number":112,"context_line":"trusted mode."},{"line_number":113,"context_line":""}],"source_content_type":"text/x-rst","patch_set":14,"id":"df7087c5_8695ab42","line":110,"range":{"start_line":110,"start_character":26,"end_line":110,"end_character":31},"updated":"2018-03-22 19:04:54.000000000","message":"\". This attribute...\"","commit_id":"430262b013eef7969c2910d6fa569bec7161741a"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"7d8533a07ca72313fab93d5d3d95fb223231b932","unresolved":false,"context_lines":[{"line_number":108,"context_line":""},{"line_number":109,"context_line":"A new attribute \u0027vf_trusted\u0027 will be add to object"},{"line_number":110,"context_line":"`NetworkInterfaceMetadata` This attribute will be set only if the"},{"line_number":111,"context_line":"interface is type SRIOV VF and will indicate whether the VF is using"},{"line_number":112,"context_line":"trusted mode."},{"line_number":113,"context_line":""},{"line_number":114,"context_line":"  ``vf_trusted: fields.BooleanField()``"}],"source_content_type":"text/x-rst","patch_set":14,"id":"df7087c5_66a657ae","line":111,"range":{"start_line":111,"start_character":13,"end_line":111,"end_character":26},"updated":"2018-03-22 19:04:54.000000000","message":"So vif[\u0027type\u0027] in https://github.com/openstack/nova/blob/315a4d63c223690c66fa448a20d77ec23148016f/nova/network/model.py#L111 right? Same as here:\n\nhttps://github.com/openstack/nova/blob/315a4d63c223690c66fa448a20d77ec23148016f/nova/compute/manager.py#L1943","commit_id":"430262b013eef7969c2910d6fa569bec7161741a"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"b0c6c0b5dcd0722e0c14d35f5b78e5df66e28328","unresolved":false,"context_lines":[{"line_number":108,"context_line":""},{"line_number":109,"context_line":"A new attribute \u0027vf_trusted\u0027 will be add to object"},{"line_number":110,"context_line":"`NetworkInterfaceMetadata` This attribute will be set only if the"},{"line_number":111,"context_line":"interface is type SRIOV VF and will indicate whether the VF is using"},{"line_number":112,"context_line":"trusted mode."},{"line_number":113,"context_line":""},{"line_number":114,"context_line":"  ``vf_trusted: fields.BooleanField()``"}],"source_content_type":"text/x-rst","patch_set":14,"id":"df7087c5_6e7937fa","line":111,"range":{"start_line":111,"start_character":13,"end_line":111,"end_character":26},"in_reply_to":"df7087c5_25428269","updated":"2018-03-23 13:09:52.000000000","message":"OK, it would be good to be clear in the spec then.","commit_id":"430262b013eef7969c2910d6fa569bec7161741a"},{"author":{"_account_id":7730,"name":"Sahid Orentino Ferdjaoui","email":"sahid.ferdjaoui@industrialdiscipline.com","username":"sahid"},"change_message_id":"7323ac6082c2b5833b4d259936909b9a1735dde9","unresolved":false,"context_lines":[{"line_number":108,"context_line":""},{"line_number":109,"context_line":"A new attribute \u0027vf_trusted\u0027 will be add to object"},{"line_number":110,"context_line":"`NetworkInterfaceMetadata` This attribute will be set only if the"},{"line_number":111,"context_line":"interface is type SRIOV VF and will indicate whether the VF is using"},{"line_number":112,"context_line":"trusted mode."},{"line_number":113,"context_line":""},{"line_number":114,"context_line":"  ``vf_trusted: fields.BooleanField()``"}],"source_content_type":"text/x-rst","patch_set":14,"id":"df7087c5_25428269","line":111,"range":{"start_line":111,"start_character":13,"end_line":111,"end_character":26},"in_reply_to":"df7087c5_66a657ae","updated":"2018-03-23 11:03:18.000000000","message":"no no only, VF_TYPE_DIRECT. That does not make sense for TYPE_DIRECT_PHYSICAL and the other are some special cases of VF_TYPE_DIRECT where it\u0027s outside of the scope of that spec.","commit_id":"430262b013eef7969c2910d6fa569bec7161741a"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"7d8533a07ca72313fab93d5d3d95fb223231b932","unresolved":false,"context_lines":[{"line_number":111,"context_line":"interface is type SRIOV VF and will indicate whether the VF is using"},{"line_number":112,"context_line":"trusted mode."},{"line_number":113,"context_line":""},{"line_number":114,"context_line":"  ``vf_trusted: fields.BooleanField()``"},{"line_number":115,"context_line":""},{"line_number":116,"context_line":"REST API impact"},{"line_number":117,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":14,"id":"df7087c5_c68083fa","line":114,"updated":"2018-03-22 19:04:54.000000000","message":"nit: Maybe default\u003dFalse on this object, but it\u0027s an implementation detail.","commit_id":"430262b013eef7969c2910d6fa569bec7161741a"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"7d8533a07ca72313fab93d5d3d95fb223231b932","unresolved":false,"context_lines":[{"line_number":116,"context_line":"REST API impact"},{"line_number":117,"context_line":"---------------"},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"In case where the vif type is SRIOV VF the metadata service will"},{"line_number":120,"context_line":"return for the network interfaces a new json that will include a"},{"line_number":121,"context_line":"\u0027vf_trusted\u0027 attribute."},{"line_number":122,"context_line":""}],"source_content_type":"text/x-rst","patch_set":14,"id":"df7087c5_c6ae4380","line":119,"range":{"start_line":119,"start_character":22,"end_line":119,"end_character":26},"updated":"2018-03-22 19:04:54.000000000","message":"nit: \"vnic_type\"","commit_id":"430262b013eef7969c2910d6fa569bec7161741a"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"7d8533a07ca72313fab93d5d3d95fb223231b932","unresolved":false,"context_lines":[{"line_number":120,"context_line":"return for the network interfaces a new json that will include a"},{"line_number":121,"context_line":"\u0027vf_trusted\u0027 attribute."},{"line_number":122,"context_line":""},{"line_number":123,"context_line":".. code-block:: json"},{"line_number":124,"context_line":""},{"line_number":125,"context_line":"  {"},{"line_number":126,"context_line":"     \"devices\": [{"}],"source_content_type":"text/x-rst","patch_set":14,"id":"df7087c5_66c3b758","line":123,"updated":"2018-03-22 19:04:54.000000000","message":"This is blowing up the sphinx docs build.","commit_id":"430262b013eef7969c2910d6fa569bec7161741a"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"7d8533a07ca72313fab93d5d3d95fb223231b932","unresolved":false,"context_lines":[{"line_number":130,"context_line":"       \"mac\": \"01:22:22:42:22:21\","},{"line_number":131,"context_line":"       \"tags\": [\"nfvfunc1\"]"},{"line_number":132,"context_line":"       \"vlans\": [300, 1000]"},{"line_number":133,"context_line":"       \"vf_trusted\": true"},{"line_number":134,"context_line":"       ]}"},{"line_number":135,"context_line":"    }"},{"line_number":136,"context_line":""}],"source_content_type":"text/x-rst","patch_set":14,"id":"df7087c5_260cdfa3","line":133,"range":{"start_line":133,"start_character":7,"end_line":133,"end_character":25},"updated":"2018-03-22 19:04:54.000000000","message":"I think we always want this key to be in the response with a new metadata API version (see:\n\nhttps://github.com/openstack/nova/blob/315a4d63c223690c66fa448a20d77ec23148016f/nova/api/metadata/base.py#L74\n\n), and the default value is \u0027false\u0027.","commit_id":"430262b013eef7969c2910d6fa569bec7161741a"},{"author":{"_account_id":7730,"name":"Sahid Orentino Ferdjaoui","email":"sahid.ferdjaoui@industrialdiscipline.com","username":"sahid"},"change_message_id":"7323ac6082c2b5833b4d259936909b9a1735dde9","unresolved":false,"context_lines":[{"line_number":130,"context_line":"       \"mac\": \"01:22:22:42:22:21\","},{"line_number":131,"context_line":"       \"tags\": [\"nfvfunc1\"]"},{"line_number":132,"context_line":"       \"vlans\": [300, 1000]"},{"line_number":133,"context_line":"       \"vf_trusted\": true"},{"line_number":134,"context_line":"       ]}"},{"line_number":135,"context_line":"    }"},{"line_number":136,"context_line":""}],"source_content_type":"text/x-rst","patch_set":14,"id":"df7087c5_851fce6a","line":133,"range":{"start_line":133,"start_character":7,"end_line":133,"end_character":25},"in_reply_to":"df7087c5_260cdfa3","updated":"2018-03-23 11:03:18.000000000","message":"I see... you are right, thanks.","commit_id":"430262b013eef7969c2910d6fa569bec7161741a"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"c8fc72617c97c42c61dbb6f973c46eb4cfdf2b7d","unresolved":false,"context_lines":[{"line_number":64,"context_line":"                            \"physical_network\": \"phy0\","},{"line_number":65,"context_line":"                            \"trusted\": \"true\"}"},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"In Neutron the ports will have to be created with a specific bindings"},{"line_number":68,"context_line":"to request that we want enable trusted feature for the VF allocated."},{"line_number":69,"context_line":""},{"line_number":70,"context_line":".. code::"}],"source_content_type":"text/x-rst","patch_set":16,"id":"df7087c5_4e5b13f5","line":67,"range":{"start_line":67,"start_character":68,"end_line":67,"end_character":69},"updated":"2018-03-23 12:53:45.000000000","message":"binding","commit_id":"523ac5551a189bf5c22551e9aead1edc5585a8f4"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"c8fc72617c97c42c61dbb6f973c46eb4cfdf2b7d","unresolved":false,"context_lines":[{"line_number":71,"context_line":""},{"line_number":72,"context_line":"    neutron port-create \u003cnet-id\u003e \\"},{"line_number":73,"context_line":"                        --name sriov_port \\"},{"line_number":74,"context_line":"                        --vnic-type direct \\"},{"line_number":75,"context_line":"                        --binding:profile type\u003ddict trusted\u003dtrue"},{"line_number":76,"context_line":""},{"line_number":77,"context_line":"NOTE: It\u0027s important to use the same boolean representation for the"}],"source_content_type":"text/x-rst","patch_set":16,"id":"df7087c5_aefe6fac","line":74,"range":{"start_line":74,"start_character":24,"end_line":74,"end_character":42},"updated":"2018-03-23 12:53:45.000000000","message":"it\u0027s annoying that the Neutron and Nova vnic_type attributes do not correlated with each other...\n\n(not an issue with the spec... just pointing it out)","commit_id":"523ac5551a189bf5c22551e9aead1edc5585a8f4"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"c8fc72617c97c42c61dbb6f973c46eb4cfdf2b7d","unresolved":false,"context_lines":[{"line_number":84,"context_line":""},{"line_number":85,"context_line":"During the scheduling phase the PciPassthroughtFilter is matching tags"},{"line_number":86,"context_line":"from the PCI Requests with tags passed to the"},{"line_number":87,"context_line":"`pci_passtrought_whitelist` that are used to determine whether or not"},{"line_number":88,"context_line":"the instance is to be booted on a given host."},{"line_number":89,"context_line":""},{"line_number":90,"context_line":"The virt drivers will then have to read the binding profile to check"}],"source_content_type":"text/x-rst","patch_set":16,"id":"df7087c5_ce6643bc","line":87,"range":{"start_line":87,"start_character":15,"end_line":87,"end_character":16},"updated":"2018-03-23 12:53:45.000000000","message":"passthrough","commit_id":"523ac5551a189bf5c22551e9aead1edc5585a8f4"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"6407ea8ea32dd9160247ddf13a3bf6746dabd2cf","unresolved":false,"context_lines":[{"line_number":84,"context_line":""},{"line_number":85,"context_line":"During the scheduling phase the PciPassthroughtFilter is matching tags"},{"line_number":86,"context_line":"from the PCI Requests with tags passed to the"},{"line_number":87,"context_line":"`pci_passtrought_whitelist` that are used to determine whether or not"},{"line_number":88,"context_line":"the instance is to be booted on a given host."},{"line_number":89,"context_line":""},{"line_number":90,"context_line":"The virt drivers will then have to read the binding profile to check"}],"source_content_type":"text/x-rst","patch_set":16,"id":"df7087c5_0e53db6c","line":87,"range":{"start_line":87,"start_character":15,"end_line":87,"end_character":16},"in_reply_to":"df7087c5_ce6643bc","updated":"2018-03-23 13:12:41.000000000","message":"Ooo I can already see the random spell check stat pad patch coming.\n\nhttps://review.openstack.org/#/c/545528/","commit_id":"523ac5551a189bf5c22551e9aead1edc5585a8f4"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"c8fc72617c97c42c61dbb6f973c46eb4cfdf2b7d","unresolved":false,"context_lines":[{"line_number":101,"context_line":""},{"line_number":102,"context_line":"A long term view would be to use the network capabilities and add new"},{"line_number":103,"context_line":"standardized os-traits for trusted mode as well as using the placement"},{"line_number":104,"context_line":"for the scheduling phase, they are some work in-progress [6]_ [7]_."},{"line_number":105,"context_line":""},{"line_number":106,"context_line":"Data model impact"},{"line_number":107,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":16,"id":"df7087c5_0ef67bd8","line":104,"range":{"start_line":104,"start_character":26,"end_line":104,"end_character":34},"updated":"2018-03-23 12:53:45.000000000","message":"there is","commit_id":"523ac5551a189bf5c22551e9aead1edc5585a8f4"},{"author":{"_account_id":7730,"name":"Sahid Orentino Ferdjaoui","email":"sahid.ferdjaoui@industrialdiscipline.com","username":"sahid"},"change_message_id":"047a45a99427ef41766b87451f1f47ef63a1504e","unresolved":false,"context_lines":[{"line_number":113,"context_line":""},{"line_number":114,"context_line":"  ``vf_trusted: fields.BooleanField(default\u003dFalse)``"},{"line_number":115,"context_line":""},{"line_number":116,"context_line":".. _vnic type SRIOV VF: https://github.com/openstack/nova/blob/315a4d63c/nova/network/model.py#L100"},{"line_number":117,"context_line":""},{"line_number":118,"context_line":"REST API impact"},{"line_number":119,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":16,"id":"df7087c5_c88abb62","line":116,"updated":"2018-03-23 11:07:12.000000000","message":"Thanks for the update you did on the spec. I just updated the link to refer VNIC_TYPE_DIRECT.","commit_id":"523ac5551a189bf5c22551e9aead1edc5585a8f4"}]}