From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753354AbbJOWkT (ORCPT ); Thu, 15 Oct 2015 18:40:19 -0400 Received: from mail-pa0-f46.google.com ([209.85.220.46]:33288 "EHLO mail-pa0-f46.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753283AbbJOWkR (ORCPT ); Thu, 15 Oct 2015 18:40:17 -0400 Date: Thu, 15 Oct 2015 15:40:25 -0700 From: Stephen Hemminger To: Alex Williamson Cc: avi@scylladb.com, avi@cloudius-systems.com, gleb@scylladb.com, corbet@lwn.net, bruce.richardson@intel.com, mst@redhat.com, linux-kernel@vger.kernel.org, alexander.duyck@gmail.com, gleb@cloudius-systems.com, vladz@cloudius-systems.com, iommu@lists.linux-foundation.org, hjk@hansjkoch.de, gregkh@linuxfoundation.org Subject: Re: [RFC PATCH v2] vfio: Include No-IOMMU mode Message-ID: <20151015154025.6c9a17cf@xeon-e3> In-Reply-To: <20151014212933.22236.22913.stgit@gimli.home> References: <20151014212933.22236.22913.stgit@gimli.home> MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Wed, 14 Oct 2015 15:51:18 -0600 Alex Williamson wrote: > There is really no way to safely give a user full access to a DMA > capable device without an IOMMU to protect the host system. There is > also no way to provide DMA translation, for use cases such as device > assignment to virtual machines. However, there are still those users > that want userspace drivers even under those conditions. The UIO > driver exists for this use case, but does not provide the degree of > device access and programming that VFIO has. In an effort to avoid > code duplication, this introduces a No-IOMMU mode for VFIO. > > This mode requires building VFIO with CONFIG_VFIO_NOIOMMU and enabling > the "enable_unsafe_noiommu_mode" option on the vfio driver. This > should make it very clear that this mode is not safe. Additionally, > CAP_SYS_RAWIO privileges are necessary to work with groups and > containers using this mode. Groups making use of this support are > named /dev/vfio/noiommu-$GROUP and can only make use of the special > VFIO_NOIOMMU_IOMMU for the container. Use of this mode, specifically > binding a device without a native IOMMU group to a VFIO bus driver > will taint the kernel and should therefore not be considered > supported. This patch includes no-iommu support for the vfio-pci bus > driver only. > > Signed-off-by: Alex Williamson The concept looks good. I am trying it now to see how well this works for the use case of DPDK in a VM.