Skip to content

Commit cd27615

Browse files
author
Padraig O'Grady
committed
TELCODOCS-2036: Include Step 1. Configure virtual functions
TELCODOCS-2036: Include Step 2. Configure the sriov operator with the Mellanox plugin disabled TELCODOCS-2036: Include Step 3. Check virtual functions after rebooting TELCODOCS-2036: Include Step 4. Eable secure boot TELCODOCS-2036: Dev feedback applied TELCODOCS-2036: '_mod-docs-content-type' commented out TELCODOCS-2036: Mellanox topic commented out TELCODOCS-2036: Mellanox topic reinstated TELCODOCS-2036: Some full stops addded TELCODOCS-2036: Dev feedback openshift#2 applied TELCODOCS-2036: Dev feedback openshift#3 applied TELCODOCS-2036: Dev feedback openshift#4 applied TELCODOCS-2036: Dev feedback openshift#4 applied TELCODOCS-2036: Dev feedback openshift#4 applied TELCODOCS-2036: Dev feedback openshift#4 applied TELCODOCS-2036: Dev feedback openshift#4 applied TELCODOCS-2036: Dev feedback openshift#5 applied TELCODOCS-2036: Peer review feedback applied
1 parent ee86459 commit cd27615

File tree

1 file changed

+56
-64
lines changed

1 file changed

+56
-64
lines changed

‎modules/nw-sriov-nic-mlx-secure-boot.adoc‎

Lines changed: 56 additions & 64 deletions
Original file line numberDiff line numberDiff line change
@@ -2,93 +2,85 @@
22
//
33
// * networking/hardware_networks/configuring-sriov-device.adoc
44

5+
:_mod-docs-content-type: PROCEDURE
56
[id="nw-sriov-nic-mlx-secure-boot_{context}"]
6-
= MLX Secure Boot
7+
= Configuring the SR-IOV Network Operator on Mellanox cards when Secure Boot is enabled
78

8-
In some cases, you might want to split virtual functions (VFs) from the same physical function (PF) into multiple resource pools.
9-
For example, you might want some of the VFs to load with the default driver and the remaining VFs load with the `vfio-pci` driver.
10-
In such a deployment, the `pfNames` selector in your SriovNetworkNodePolicy custom resource (CR) can be used to specify a range of VFs for a pool using the following format: `<pfname>#<first_vf>-<last_vf>`.
9+
The SR-IOV Network Operator supports an option to skip the firmware configuration for Mellanox (MLX) devices. It is currently the only way to create virtual functions by using the SR-IOV Network Operator, if the system has secure boot enabled. You are required to manually configure and allocate the number of virtual functions in the firmware before switching the system to secure boot.
1110

12-
For example, the following YAML shows the selector for an interface named `netpf0` with VF `2` through `7`:
11+
[NOTE]
12+
====
13+
The number of virtual functions in the firmware are the maximum number of virtual functions that you can request in the policy.
14+
====
1315

14-
[source,yaml]
15-
----
16-
pfNames: ["netpf0#2-7"]
17-
----
18-
19-
* `netpf0` is the PF interface name.
20-
* `2` is the first VF index (0-based) that is included in the range.
21-
* `7` is the last VF index (0-based) that is included in the range.
22-
23-
You can select VFs from the same PF by using different policy CRs if the following requirements are met:
16+
.Procedure
2417

25-
* The `numVfs` value must be identical for policies that select the same PF.
26-
* The VF index must be in the range of `0` to `<numVfs>-1`. For example, if you have a policy with `numVfs` set to `8`, then the `<first_vf>` value must not be smaller than `0`, and the `<last_vf>` must not be larger than `7`.
27-
* The VFs ranges in different policies must not overlap.
28-
* The `<first_vf>` must not be larger than the `<last_vf>`.
18+
. Configure the virtual functions (VFs):
2919

30-
The following example illustrates NIC partitioning for an SR-IOV device.
31-
32-
The policy `policy-net-1` defines a resource pool `net-1` that contains the VF `0` of PF `netpf0` with the default VF driver.
33-
The policy `policy-net-1-dpdk` defines a resource pool `net-1-dpdk` that contains the VF `8` to `15` of PF `netpf0` with the `vfio` VF driver.
34-
35-
Policy `policy-net-1`:
36-
37-
[source,yaml]
20+
.. Run the following command when the system is without a secure boot when using the sriov-config daemon:
21+
+
22+
[source,terminal]
3823
----
39-
apiVersion: sriovnetwork.openshift.io/v1
40-
kind: SriovNetworkNodePolicy
41-
metadata:
42-
name: policy-net-1
43-
namespace: openshift-sriov-network-operator
44-
spec:
45-
resourceName: net1
46-
nodeSelector:
47-
feature.node.kubernetes.io/network-sriov.capable: "true"
48-
numVfs: 16
49-
nicSelector:
50-
pfNames: ["netpf0#0-0"]
51-
deviceType: netdevice
24+
$ mstconfig -d -0001:b1:00.1 set SRIOV_EN=1 NUM_OF_VFS=16 <1> <2>
5225
----
26+
<1> The `SRIOV_EN` environment variable enables the SR-IOV Network Operator support on the Mellanox card.
27+
<2> The `NUM_OF_VFS` environment variable specifies the number of virtual functions to enable in the firmware.
5328

54-
Policy `policy-net-1-dpdk`:
55-
29+
. Configure the SR-IOV Network Operator by disabling the Mellanox plugin. See the following `SriovOperatorConfig` example configuration:
30+
+
5631
[source,yaml]
5732
----
5833
apiVersion: sriovnetwork.openshift.io/v1
59-
kind: SriovNetworkNodePolicy
34+
kind: SriovOperatorConfig
6035
metadata:
61-
name: policy-net-1-dpdk
36+
name: default
6237
namespace: openshift-sriov-network-operator
6338
spec:
64-
resourceName: net1dpdk
65-
nodeSelector:
66-
feature.node.kubernetes.io/network-sriov.capable: "true"
67-
numVfs: 16
68-
nicSelector:
69-
pfNames: ["netpf0#8-15"]
70-
deviceType: vfio-pci
39+
configDaemonNodeSelector: {}
40+
configurationMode: daemon
41+
disableDrain: false
42+
disablePlugins:
43+
- mellanox
44+
enableInjector: true
45+
enableOperatorWebhook: true
46+
logLevel: 2
7147
----
7248

73-
.Verifying that the interface is successfully partitioned
74-
Confirm that the interface partitioned to virtual functions (VFs) for the SR-IOV device by running the following command.
49+
. Reboot the system to enable the virtual functions and the configuration settings.
7550

51+
. Check the virtual functions (VFs) after rebooting the system by running the following command:
52+
+
7653
[source,terminal]
7754
----
78-
$ ip link show <interface> <1>
55+
$ oc -n openshift-sriov-network-operator get sriovnetworknodestate.sriovnetwork.openshift.io worker-0 -oyaml
7956
----
57+
+
58+
[source,yaml]
59+
----
60+
- deviceID: 101d
61+
driver: mlx5_core
62+
eSwitchMode: legacy
63+
linkSpeed: -1 Mb/s
64+
linkType: ETH
65+
mac: 08:c0:eb:96:31:25
66+
mtu: 1500
67+
name: ens3f1np1
68+
pciAddress: 0000:b1:00.1 <1>
69+
totalvfs: 16
70+
vendor: 15b3
71+
----
72+
<1> The `totalvfs` value is the same number used in the `mstconfig` command earlier in the procedure.
8073

81-
<1> Replace `<interface>` with the interface that you specified when partitioning to VFs for the SR-IOV device, for example, `ens3f1`.
74+
. Enable secure boot
75+
Enabling secure boot improves your system's security by preventing unauthorized operating systems and malicious software from loading during the device's boot process.
8276

83-
.Example output
77+
.. Enable secure boot using the BIOS (Basic Input/Output System).
78+
+
8479
[source,terminal]
8580
----
86-
5: ens3f1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP mode DEFAULT group default qlen 1000
87-
link/ether 3c:fd:fe:d1:bc:01 brd ff:ff:ff:ff:ff:ff
88-
89-
vf 0 link/ether 5a:e7:88:25:ea:a0 brd ff:ff:ff:ff:ff:ff, spoof checking on, link-state auto, trust off
90-
vf 1 link/ether 3e:1d:36:d7:3d:49 brd ff:ff:ff:ff:ff:ff, spoof checking on, link-state auto, trust off
91-
vf 2 link/ether ce:09:56:97:df:f9 brd ff:ff:ff:ff:ff:ff, spoof checking on, link-state auto, trust off
92-
vf 3 link/ether 5e:91:cf:88:d1:38 brd ff:ff:ff:ff:ff:ff, spoof checking on, link-state auto, trust off
93-
vf 4 link/ether e6:06:a1:96:2f:de brd ff:ff:ff:ff:ff:ff, spoof checking on, link-state auto, trust off
81+
Secure Boot: Enabled
82+
Secure Boot Policy: Standard
83+
Secure Boot Mode: Mode Deployed
9484
----
85+
86+
.. Reboot the system.

0 commit comments

Comments
 (0)