30/10/2019 05:08, Jerin Jacob: > On Wed, Oct 30, 2019 at 12:21 AM Thomas Monjalon <tho...@monjalon.net> wrote: > > > > In a virtual environment, the network controller may have to configure > > some SR-IOV VF parameters for security reasons. > > Just to understand, Could you explain more details/examples for > security reasons?
Examples are setting the MAC address or the promiscuous mode. These settings should be decided by the hypervisor, and not freely set by the VM. > > When the PF (host port) is driven by DPDK (OVS-DPDK case), > > we face two different cases: > > - driver is bifurcated (Mellanox case), > > so the VF can be configured via the kernel. > > - driver is on top of UIO or VFIO, so DPDK API is required, > > Not true. Both UIO and VFIO are NOT allowed to create SRIOV VF from > the PF device. > It is only allowed through igb-uio out of tree driver without iommu support. Not sure I said the contrary. igb_uio and vfio_pf are 2 implementations of UIO and VFIO. > > and PMD-specific APIs were used. > > This new generic API will avoid vendors fragmentation. > > The API is good. But I have concerns about the vendor implementation > of this API. > It can support only vendors with bifurcated driver(Mellanox case). > or using igb_uio(non iommu case) but not the devices with VFIO(Which > is the first-class citizen). Why not? (see above) The API is agnostic to the kernel driver in use. > All the control plane control stuff to replace Linux with "port > representor" logic > will be of the mercy of an "out of tree" driver either with igb_uio > or http://patches.dpdk.org/patch/58810/ > > I am _not against_ on DPDK supports port representor or controlling > netdev VF traffic, > but if we have taken that path then DPDK should have the > infrastructure to support for > all driver models like VFIO(Addressed in [1]) > > I would have this question when DPDK starts supporting port > representor(but I was not > aware that kernel security issue on netdev ports controlled by DPDK in > non-bifurcated driver case > and concise effort block such scheme by kernel [2]) > > > [1] > http://patches.dpdk.org/patch/58810/ > [2] > https://patchwork.kernel.org/patch/10522381/ I feel you are using this thread to promote your vfio_pf implementation. But this API and the kernel module are orthogonals. Please can we focus on the DPDK API in this thread, and talk about VFIO implementation in the other thread?
