Message ID | 20230705100430.61927-1-maxime.coquelin@redhat.com |
---|---|
Headers |
Return-Path: <linux-kernel-owner@vger.kernel.org> Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:9f45:0:b0:3ea:f831:8777 with SMTP id v5csp1774925vqx; Wed, 5 Jul 2023 03:49:02 -0700 (PDT) X-Google-Smtp-Source: APBJJlFb3j3mqu70ZuOJ8VzJlzxsBne+PN4VXIPHDl9CrmDb1UaBtPLyxrr2FNvSFywtDnhORsLm X-Received: by 2002:a05:6a20:918e:b0:12e:ae1a:4c1c with SMTP id v14-20020a056a20918e00b0012eae1a4c1cmr9514313pzd.36.1688554142417; Wed, 05 Jul 2023 03:49:02 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1688554142; cv=none; d=google.com; s=arc-20160816; b=u7wmCb9oQrwYs2kMR3wVK3N/h5MXbVeA7TlRcDkDMMYV7UDAlSrtaLfdCwvd0H6C/s Wp072FxHqzoCCdm8FOuwEMzRvzA3oFotH0aPLVwNzc4sshjrTNuRbLiZ1CATDEqEqiS1 oedK3hx6ucQbm9b6F2Mi34JuwpAHDc3Z0G3aAgwxjrorXVsHH950zU/E6vsoETrKF7s7 NR4Cmiz9PyCtAhssKbHCJ5YSVAzEwTCmm5PnwXWEqWLEpBnsOSIOYWg7Ur92Pr+A2zvg QcDC11p8OdmQfFcLcu+0PbT2lCgDWhmZs1iCcThR3+VIhsya+tXgTWalMxl6HDIkH25F pcLA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from:dkim-signature; bh=aSkrBix+gmKUXf56ayGwj/+UAI9bmUZXFChpiR2otpI=; fh=S1rZK6DPg0mAED4KjNm0cP4EEY87q6FXHFEeosELg0E=; b=vbFRFMnZ0q9NTbkcQjf+WyGbEIHyyHF1HSvIaxMcYoqdQlNW+LFPMdisq84rtckOah ooWua+7dIVVt3AfVlAkxIU4cb5hgOYBwvd9ERGtpSklGnLfvXL3rk76z4NaTgGLIazDj RLRaECBQFtH/wBTBjnyCCwh6B1BY1a16uODblidSQ+9CBP7hp8VkFbxb2Eu8dqarphL9 Gt/AKOh5aef2Zpj8bSTP05Jxg6+XB35XRBbrsoQJrFWjlHh2GzP9HKl4jzeQAvg7DNLQ 6MxiYOUoK/fn+ZItXTab8SJeiwTxX968fTPcD+daG6QZRW68SBFCdg0EIakF2mbfM+xp /epQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@redhat.com header.s=mimecast20190719 header.b=CKdiFcCR; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=redhat.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id cd19-20020a056a00421300b00679a6ce03f6si19065334pfb.59.2023.07.05.03.48.49; Wed, 05 Jul 2023 03:49:02 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@redhat.com header.s=mimecast20190719 header.b=CKdiFcCR; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=redhat.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231408AbjGEKF0 (ORCPT <rfc822;tebrre53rla2o@gmail.com> + 99 others); Wed, 5 Jul 2023 06:05:26 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38056 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231211AbjGEKFX (ORCPT <rfc822;linux-kernel@vger.kernel.org>); Wed, 5 Jul 2023 06:05:23 -0400 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 97253171B for <linux-kernel@vger.kernel.org>; Wed, 5 Jul 2023 03:04:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1688551476; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=aSkrBix+gmKUXf56ayGwj/+UAI9bmUZXFChpiR2otpI=; b=CKdiFcCR0rh78az1rMrA8fvzq4DnTeF72BW6YyG54sDK4Wh/XMmt/4PW9SHuu4TICWfNTs fJu1+KhySz51Vw+E0VEBYLUYWP0eFzGCpR/sIG8+T40YejyFHmeQIkhk4x+S32t+ozmeau AnPgyypr/Rz80fq9f11edlN6xVab7XY= Received: from mimecast-mx02.redhat.com (mimecast-mx02.redhat.com [66.187.233.88]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-395-Q8_SJbu4NWCwKqaj3TeNLw-1; Wed, 05 Jul 2023 06:04:35 -0400 X-MC-Unique: Q8_SJbu4NWCwKqaj3TeNLw-1 Received: from smtp.corp.redhat.com (int-mx02.intmail.prod.int.rdu2.redhat.com [10.11.54.2]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 394BA101A529; Wed, 5 Jul 2023 10:04:35 +0000 (UTC) Received: from max-t490s.redhat.com (unknown [10.39.208.34]) by smtp.corp.redhat.com (Postfix) with ESMTP id C85E84021523; Wed, 5 Jul 2023 10:04:32 +0000 (UTC) From: Maxime Coquelin <maxime.coquelin@redhat.com> To: xieyongji@bytedance.com, jasowang@redhat.com, mst@redhat.com, david.marchand@redhat.com, lulu@redhat.com Cc: linux-kernel@vger.kernel.org, virtualization@lists.linux-foundation.org, netdev@vger.kernel.org, xuanzhuo@linux.alibaba.com, eperezma@redhat.com, Maxime Coquelin <maxime.coquelin@redhat.com> Subject: [PATCH v3 0/3] vduse: add support for networking devices Date: Wed, 5 Jul 2023 12:04:27 +0200 Message-ID: <20230705100430.61927-1-maxime.coquelin@redhat.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Scanned-By: MIMEDefang 3.1 on 10.11.54.2 X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_NONE, RCVD_IN_MSPIKE_H4,RCVD_IN_MSPIKE_WL,SPF_HELO_NONE,SPF_NONE, T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: <linux-kernel.vger.kernel.org> X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1770577348334451368?= X-GMAIL-MSGID: =?utf-8?q?1770577348334451368?= |
Series |
vduse: add support for networking devices
|
|
Message
Maxime Coquelin
July 5, 2023, 10:04 a.m. UTC
This small series enables virtio-net device type in VDUSE. With it, basic operation have been tested, both with virtio-vdpa and vhost-vdpa using DPDK Vhost library series adding VDUSE support using split rings layout (merged in DPDK v23.07-rc1). Control queue support (and so multiqueue) has also been tested, but requires a Kernel series from Jason Wang relaxing control queue polling [1] to function reliably, so while Jason rework is done, a patch is added to disable CVQ and features that depend on it (tested also with DPDK v23.07-rc1). [1]: https://lore.kernel.org/lkml/CACGkMEtgrxN3PPwsDo4oOsnsSLJfEmBEZ0WvjGRr3whU+QasUg@mail.gmail.com/T/ v2 -> v3 changes: ================= - Use allow list instead of deny list (Michael) v1 -> v2 changes: ================= - Add a patch to disable CVQ (Michael) RFC -> v1 changes: ================== - Fail device init if it does not support VERSION_1 (Jason) Maxime Coquelin (3): vduse: validate block features only with block devices vduse: enable Virtio-net device type vduse: Temporarily disable control queue features drivers/vdpa/vdpa_user/vduse_dev.c | 51 +++++++++++++++++++++++++++--- 1 file changed, 47 insertions(+), 4 deletions(-)
Comments
On Wed, Jul 05, 2023 at 12:04:27PM +0200, Maxime Coquelin wrote: > This small series enables virtio-net device type in VDUSE. > With it, basic operation have been tested, both with > virtio-vdpa and vhost-vdpa using DPDK Vhost library series > adding VDUSE support using split rings layout (merged in > DPDK v23.07-rc1). > > Control queue support (and so multiqueue) has also been > tested, but requires a Kernel series from Jason Wang > relaxing control queue polling [1] to function reliably, > so while Jason rework is done, a patch is added to disable > CVQ and features that depend on it (tested also with DPDK > v23.07-rc1). So I can put this in next, the issue I think is that of security: currently selinux can if necessary block access to creating virtio block devices. But if we have more than one type we need a way for selinux to block specific types. Can be a patch on top but pls work to address. Another question is that with this userspace can inject packets directly into net stack. Should we check CAP_NET_ADMIN or such? > [1]: https://lore.kernel.org/lkml/CACGkMEtgrxN3PPwsDo4oOsnsSLJfEmBEZ0WvjGRr3whU+QasUg@mail.gmail.com/T/ > > v2 -> v3 changes: > ================= > - Use allow list instead of deny list (Michael) > > v1 -> v2 changes: > ================= > - Add a patch to disable CVQ (Michael) > > RFC -> v1 changes: > ================== > - Fail device init if it does not support VERSION_1 (Jason) > > Maxime Coquelin (3): > vduse: validate block features only with block devices > vduse: enable Virtio-net device type > vduse: Temporarily disable control queue features > > drivers/vdpa/vdpa_user/vduse_dev.c | 51 +++++++++++++++++++++++++++--- > 1 file changed, 47 insertions(+), 4 deletions(-) > > -- > 2.41.0
On Thu, 10 Aug 2023 15:04:27 -0400 Michael S. Tsirkin wrote: > Another question is that with this userspace can inject > packets directly into net stack. Should we check CAP_NET_ADMIN > or such? Directly into the stack? I thought VDUSE is vDPA in user space, meaning to get to the kernel the packet has to first go thru a virtio-net instance. Or you mean directly into the network?
On Thu, Aug 10, 2023 at 02:29:49PM -0700, Jakub Kicinski wrote: > On Thu, 10 Aug 2023 15:04:27 -0400 Michael S. Tsirkin wrote: > > Another question is that with this userspace can inject > > packets directly into net stack. Should we check CAP_NET_ADMIN > > or such? > > Directly into the stack? I thought VDUSE is vDPA in user space, > meaning to get to the kernel the packet has to first go thru > a virtio-net instance. yes. is that a sufficient filter in your opinion? > Or you mean directly into the network?
On Thu, 10 Aug 2023 17:42:11 -0400 Michael S. Tsirkin wrote: > > Directly into the stack? I thought VDUSE is vDPA in user space, > > meaning to get to the kernel the packet has to first go thru > > a virtio-net instance. > > yes. is that a sufficient filter in your opinion? Yes, the ability to create the device feels stronger than CAP_NET_RAW, and a bit tangential to CAP_NET_ADMIN. But I don't have much practical experience with virt so no strong opinion, perhaps it does make sense for someone's deployment? Dunno..