Messages in this thread | | | Subject | Re: [RFC net-next 0/8] Introducing subdev bus and devlink extension | From | Yunsheng Lin <> | Date | Wed, 9 Jun 2021 20:30:14 +0800 |
| |
On 2021/6/9 19:59, Parav Pandit wrote: >> From: Yunsheng Lin <linyunsheng@huawei.com> >> Sent: Wednesday, June 9, 2021 4:35 PM >> >> On 2021/6/9 17:38, Parav Pandit wrote: >>> >>>> From: Yunsheng Lin <linyunsheng@huawei.com> >>>> Sent: Wednesday, June 9, 2021 2:46 PM >>>> >>> [..] >>> >>>>>> Is there any reason why VF use its own devlink instance? >>>>> >>>>> Primary use case for VFs is virtual environments where guest isn't >>>>> trusted, so tying the VF to the main devlink instance, over which >>>>> guest should have no control is counter productive. >>>> >>>> The security is mainly about VF using in container case, right? >>>> Because VF using in VM, it is different host, it means a different >>>> devlink instance for VF, so there is no security issue for VF using in VM >> case? >>>> But it might not be the case for VF using in container? >>> Devlink instance has net namespace attached to it controlled using devlink >> reload command. >>> So a VF devlink instance can be assigned to a container/process running in a >> specific net namespace. >>> >>> $ ip netns add n1 >>> $ devlink dev reload pci/0000:06:00.4 netns n1 >>> ^^^^^^^^^^^^^ >>> PCI VF/PF/SF. >> >> Could we create another devlink instance when the net namespace of >> devlink port instance is changed? > Net namespace of (a) netdevice (b) rdma device (c) devlink instance can be changed. > Net namespace of devlink port cannot be changed.
Yes, net namespace is changed based on the devlink instance, not devlink port instance, *right now*.
> >> It may seems we need to change the net >> namespace based on devlink port instance instead of devlink instance. >> This way container case seems be similiar to the VM case? > I mostly do not understand the topology you have in mind or if you explained previously I missed the thread. > In your case what is the flavour of a devlink port?
flavour of the devlink port instance is FLAVOUR_PHYSICAL or FLAVOUR_VIRTUAL.
The reason I suggest to change the net namespace on devlink port instance instead of devlink instance is: I proposed that all the PF and VF in the same ASIC are registered to the same devlink instance as flavour FLAVOUR_PHYSICAL or FLAVOUR_VIRTUAL when there are in the same host and in the same net namespace.
If a VF's devlink port instance is unregistered from old devlink instance in the old net namespace and registered to new devlink instance in the new net namespace(create a new devlink instance if needed) when devlink port instance's net namespace is changed, then the security mentioned by jakub is not a issue any more?
> >> >>> >>>> Also, there is a "switch_id" concept from jiri's example, which seems >>>> to be not implemented yet? >>> >>> switch_id is present for switch ports in [1] and documented in [2]. >>> >>> [1] /sys/class/net/representor_netdev/phys_switch_id. >>> [2] >> https://www.kernel.org/doc/Documentation/networking/switchdev.txt " >> Switch ID" >> >> Thanks for info. >> I suppose we could use "switch_id" to indentify a eswitch since "switch_id is >> present for switch ports"? >> Where does the "switch_id" of switch port come from? Is it from FW? >> Or the driver generated it? >> >> Is there any rule for "switch_id"? Or is it vendor specific? >> >>> > It should be unique enough, usually generated out of board serial id or other fields such as vendor OUI that makes it fairly unique. > >
| |