From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43) id 1NZvQR-0000Hs-Cq for qemu-devel@nongnu.org; Tue, 26 Jan 2010 19:06:27 -0500 Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43) id 1NZvQM-0000Hg-Vv for qemu-devel@nongnu.org; Tue, 26 Jan 2010 19:06:26 -0500 Received: from [199.232.76.173] (port=60586 helo=monty-python.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1NZvQM-0000Hd-Po for qemu-devel@nongnu.org; Tue, 26 Jan 2010 19:06:22 -0500 Received: from mail-iw0-f188.google.com ([209.85.223.188]:39899) by monty-python.gnu.org with esmtp (Exim 4.60) (envelope-from ) id 1NZvQM-00063J-Es for qemu-devel@nongnu.org; Tue, 26 Jan 2010 19:06:22 -0500 Received: by iwn26 with SMTP id 26so5513513iwn.14 for ; Tue, 26 Jan 2010 16:06:21 -0800 (PST) Message-ID: <4B5F8379.6060607@codemonkey.ws> Date: Tue, 26 Jan 2010 18:06:17 -0600 From: Anthony Liguori MIME-Version: 1.0 Subject: Re: [Qemu-devel] Re: [PATCH qemu-kvm] Add raw(af_packet) network backend to qemu References: <1264538423.24933.144.camel@w-sridhar.beaverton.ibm.com> <4B5F54E8.3080507@codemonkey.ws> <1264547735.24933.244.camel@w-sridhar.beaverton.ibm.com> In-Reply-To: <1264547735.24933.244.camel@w-sridhar.beaverton.ibm.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit List-Id: qemu-devel.nongnu.org List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Sridhar Samudrala Cc: markmc@redhat.com, kvm@vger.kernel.org, "Michael S. Tsirkin" , qemu-devel@nongnu.org, ogerlitz@voltaire.com, avi@redhat.com On 01/26/2010 05:15 PM, Sridhar Samudrala wrote: > On Tue, 2010-01-26 at 14:47 -0600, Anthony Liguori wrote: > >> On 01/26/2010 02:40 PM, Sridhar Samudrala wrote: >> >>> This patch adds raw socket backend to qemu and is based on Or Gerlitz's >>> patch re-factored and ported to the latest qemu-kvm git tree. >>> It also includes support for vnet_hdr option that enables gso/checksum >>> offload with raw backend. You can find the linux kernel patch to support >>> this feature here. >>> http://thread.gmane.org/gmane.linux.network/150308 >>> >>> Signed-off-by: Sridhar Samudrala >>> >>> >> See the previous discussion about the raw backend from Or's original >> patch. There's no obvious reason why we should have this in addition to >> a tun/tap backend. >> >> The only use-case I know of is macvlan but macvtap addresses this >> functionality while not introduce the rather nasty security problems >> associated with a raw backend. >> > The raw backend can be attached to a physical device This is equivalent to bridging with tun/tap except that it has the unexpected behaviour of unreliable host/guest networking (which is not universally consistent across platforms either). This is not a mode we want to encourage users to use. > , macvlan macvtap is a superior way to achieve this use case because a macvtap fd can safely be given to a lesser privilege process without allowing escalation of privileges. > or SR-IOV VF. > This depends on vhost-net. In general, what I would like to see for this is something more user friendly that dealt specifically with this use-case. Although honestly, given the recent security concerns around raw sockets, I'm very concerned about supporting raw sockets in qemu at all. Essentially, you get worse security doing vhost-net + raw + VF then with PCI passthrough + VF because at least in the later case you can run qemu without privileges. CAP_NET_RAW is a very big privilege. Regards, Anthony Liguori