From mboxrd@z Thu Jan 1 00:00:00 1970 From: Anthony Liguori Subject: Re: [PATCH qemu-kvm] Add raw(af_packet) network backend to qemu Date: Thu, 28 Jan 2010 08:39:40 -0600 Message-ID: <4B61A1AC.1080309@codemonkey.ws> References: <4B5F54E8.3080507@codemonkey.ws> <20100127180338.GB13730@redhat.com> <4B6099E0.40101@codemonkey.ws> <201001280912.04809.arnd@arndb.de> <20100128135644.GE3776@redhat.com> <4B619BA1.9010404@codemonkey.ws> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Cc: Arnd Bergmann , Sridhar Samudrala , avi@redhat.com, markmc@redhat.com, ogerlitz@voltaire.com, kvm@vger.kernel.org, qemu-devel@vger.kernel.org To: "Michael S. Tsirkin" Return-path: Received: from mail-iw0-f172.google.com ([209.85.223.172]:61985 "EHLO mail-iw0-f172.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753420Ab0A1Ojp (ORCPT ); Thu, 28 Jan 2010 09:39:45 -0500 In-Reply-To: <4B619BA1.9010404@codemonkey.ws> Sender: kvm-owner@vger.kernel.org List-ID: On 01/28/2010 08:13 AM, Anthony Liguori wrote: > On 01/28/2010 07:56 AM, Michael S. Tsirkin wrote: >>> Now, the most important use case I see for the raw socket interface >>> in qemu is to get vhost-net and the qemu user implementation to >>> support the same feature set. If you ask for a network setup involving >>> a raw socket and vhost-net and the kernel can support raw sockets >>> but for some reason fails to set up vhost-net, you should have a >>> fallback that has the exact same semantics at a possibly significant >>> performance loss. >>> >>> Arnd >> Makes sense. A simple reason you can't do vhost-net would be >> that you are using tcg. > > Some good arguments have been raised in this thread. I really don't > like making our security depend on something external to qemu that is > not widely used or understood. Thinking about it, I don't think network namespaces actually provides us the security that we need. It's quite easy to break out of it if not being used in the context of a full container. But this discussion belongs in netdev, I'll raise the issue there. Regards, Anthony Liguori