netdev - Re: [PATCH net-next v3 0/5]: ixgbevf: Allow querying VFs RSS indirection table and key

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Tue, 6 Jan 2015 13:13:51 -0800
From:	Greg Rose <gvrose8192@...il.com>
To:	Vlad Zolotarov <vladz@...udius-systems.com>
Cc:	Gleb Natapov <gleb@...udius-systems.com>, netdev@...r.kernel.org,
	Avi Kivity <avi@...udius-systems.com>,
	jeffrey.t.kirsher@...el.com
Subject: Re: [PATCH net-next v3 0/5]: ixgbevf: Allow querying VFs RSS
 indirection table and key

On Tue, Jan 6, 2015 at 12:13 PM, Vlad Zolotarov
<vladz@...udius-systems.com> wrote:
>
> On 01/06/15 20:22, Greg Rose wrote:
>>

[snip]

>> I have not reached any such conclusion - let me reiterate:  I have no
>> idea.  It is not my area of expertise.  However, to take the lowest
>> risk route just add a policy hook so that a system admin can turn the
>> feature on through the PF driver (which is acknowledged as secure) if
>> they wish then there is no worry.
>
>
> NP. Let's move on.
>
>>> However I don't want to argue about any longer. Let's move on.
>>>
>>> Let's clarify one thing about this "hook". Do u agree that it should
>>> cover
>>> only the cases when VF shares the mentioned above data with PF - namely
>>> for
>>> all devices but x550?
>>
>> Look at how spoof checking is turned off/on for each VF using the "ip
>> link set" commands.  That's what I'm envisioning - some way to decide
>> on a per VF basis which VFs should be allowed to perform the query.
>
>
> I will but let's agree that x550 VFs should be out of this since their RSS
> indirection table and Key belong to the specific domain and don't impose any
> even theoretical thread.

Sounds good to me.

Thanks!

- Greg

>
>
> thanks,
> vlad
>
>> Thanks,
>>
>> - Greg
>
>
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html