netdev - Re: [RFC PATCH 1/4] net: Add support to netdev ops for changing hardware queue MAC and VLAN filters

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20091130225751.GI11152@verge.net.au>
Date:	Tue, 1 Dec 2009 09:57:51 +1100
From:	Simon Horman <horms@...ge.net.au>
To:	"Williams, Mitch A" <mitch.a.williams@...el.com>
Cc:	Ben Hutchings <bhutchings@...arflare.com>,
	"Kirsher, Jeffrey T" <jeffrey.t.kirsher@...el.com>,
	"davem@...emloft.net" <davem@...emloft.net>,
	"shemminger@...tta.com" <shemminger@...tta.com>,
	"netdev@...r.kernel.org" <netdev@...r.kernel.org>,
	"gospo@...hat.com" <gospo@...hat.com>
Subject: Re: [RFC PATCH 1/4] net: Add support to netdev ops for changing
 hardware queue MAC and VLAN filters

On Mon, Nov 30, 2009 at 11:36:08AM -0700, Williams, Mitch A wrote:
> >From: Simon Horman [mailto:horms@...ge.net.au]
> >Sent: Sunday, November 29, 2009 10:03 PM
> 
> >> The issue of which VF goes with which PF device can be deduced in
> >> userspace via sysfs.
> >
> >Does this mean that the configuration of filtering for a VF needs
> >to be done where the interface for the VF exists - e.g. in a KVM
> >guest/Xen domU?
> >
> 
> No, all of the configuration is done through the PF device.  What I was
> saying was that, given a specific VF PCI device (which would be passed
> through to the VM), you can use sysfs to determine which PF owns it, and
> then run the ip command to tell the PF to configure the VF.

Understood, sorry I missed that the first time around.

> >In terms of dealing with interfaces and the way that tools such as ip work
> >that makes a lot of sense. But I wonder if it actually makes more sense
> >from an administrative point of view to have this configuration go through
> >the PF - e.g. the KVM host/Xen domO.
> 
> >From a policy and security standpoint, you can't allow the VM to handle
> >its own hardware configuration. The host/hypervisor/VM Manager/boss has
> >to handle this or you lose many of the advantages of virtualization
> >(i.e. isolation, security, stability, etc).

Yes, agreed.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html