From: "Wu, Jingjing" <jingjing.wu@intel.com>
To: Vladislav Zolotarov <vladz@cloudius-systems.com>
Cc: "dev@dpdk.org" <dev@dpdk.org>, "Pei, Yulong" <yulong.pei@intel.com>
Subject: Re: [dpdk-dev] [PATCH] i40e: workaround for Security issue in SR-IOV mode
Date: Thu, 8 Oct 2015 02:17:19 +0000 [thread overview]
Message-ID: <9BB6961774997848B5B42BEC655768F8CECC60@SHSMSX104.ccr.corp.intel.com> (raw)
In-Reply-To: <CAOYyTHag3u+6TiCQieT7zRCDgAi77EOrFz9BJP5oGocR8K3wTQ@mail.gmail.com>
>>
>> In SR-IOV mode a VF sending LFC or PFC would throttle the entire port.
>> The workaround is to add a filter to drop pause frames from VFs from
>> sending pause frames.
>This is a very strange approach - this would silently disable the Tx FC while a user would think it's enabled. Wouldn't the right approach be to let the user decide weather to enable this feature or even better - allow PF to disable this feature in the VF?
So, even we let VF sending Tx, it does not make sense at all. As my understanding, Flow control is used for full-duplex point-to-point connections. How about VF? What is its peer for the point-to-point connect? So if we enable it, it will be a security risk if attacker sends FC on VFs.
Thanks
Jingjing
next prev parent reply other threads:[~2015-10-08 2:19 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-09-25 8:44 Jingjing Wu
2015-09-25 12:28 ` Vladislav Zolotarov
2015-10-08 2:17 ` Wu, Jingjing [this message]
2015-10-08 14:53 ` Vlad Zolotarov
2015-10-13 7:18 ` [dpdk-dev] [PATCH v2] i40e: Add a workaround to drop flow control frames from VFs Jingjing Wu
2015-10-19 6:31 ` [dpdk-dev] [PATCH v3] " Jingjing Wu
2015-10-19 8:31 ` Lu, Wenzhuo
2015-10-30 5:31 ` Zhang, Helin
2015-10-30 11:24 ` Thomas Monjalon
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=9BB6961774997848B5B42BEC655768F8CECC60@SHSMSX104.ccr.corp.intel.com \
--to=jingjing.wu@intel.com \
--cc=dev@dpdk.org \
--cc=vladz@cloudius-systems.com \
--cc=yulong.pei@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).