[dpdk-dev] [PATCH] i40e: workaround for Security issue in SR-IOV mode

Wu, Jingjing jingjing.wu at intel.com
Thu Oct 8 04:17:19 CEST 2015


>>
>> In SR-IOV mode a VF sending LFC or PFC would throttle the entire port.
>> The workaround is to add a filter to drop pause frames from VFs from
>> sending pause frames.
>This is a very strange approach - this would silently disable the Tx FC while a user would think it's enabled. Wouldn't the right approach be to let the user decide weather to enable this feature or even better - allow PF to disable this feature in the VF? 

So, even we let VF sending Tx, it does not make sense at all.  As my understanding, Flow control is used for full-duplex point-to-point connections. How about VF? What is its peer for the point-to-point connect? So if we enable it, it will be a security risk if attacker sends FC on VFs. 

Thanks
Jingjing


More information about the dev mailing list