archive mirror
 help / color / mirror / Atom feed
* [PATCH v3 0/7] vfio/pci: SR-IOV support
@ 2020-03-11 21:58 Alex Williamson
  2020-03-11 21:58 ` [PATCH v3 1/7] vfio: Include optional device match in vfio_device_ops callbacks Alex Williamson
                   ` (7 more replies)
  0 siblings, 8 replies; 14+ messages in thread
From: Alex Williamson @ 2020-03-11 21:58 UTC (permalink / raw)
  To: kvm
  Cc: linux-pci, linux-kernel, dev, mtosatti, thomas, bluca,
	jerinjacobk, bruce.richardson, cohuck, kevin.tian

Only minor tweaks since v2, GET and SET on VFIO_DEVICE_FEATURE are
enforced mutually exclusive except with the PROBE option as suggested
by Connie, the modinfo text has been expanded for the opt-in to enable
SR-IOV support in the vfio-pci driver per discussion with Kevin.

I have not incorporated runtime warnings attempting to detect misuse
of SR-IOV or imposed a session lifetime of a VF token, both of which
were significant portions of the discussion of the v2 series.  Both of
these also seem to impose a usage model or make assumptions about VF
resource usage or configuration requirements that don't seem necessary
except for the sake of generating a warning or requiring an otherwise
unnecessary and implicit token reinitialization.  If there are new
thoughts around these or other discussion points, please raise them.

Series overview (same as provided with v1):

The synopsis of this series is that we have an ongoing desire to drive
PCIe SR-IOV PFs from userspace with VFIO.  There's an immediate need
for this with DPDK drivers and potentially interesting future use
cases in virtualization.  We've been reluctant to add this support
previously due to the dependency and trust relationship between the
VF device and PF driver.  Minimally the PF driver can induce a denial
of service to the VF, but depending on the specific implementation,
the PF driver might also be responsible for moving data between VFs
or have direct access to the state of the VF, including data or state
otherwise private to the VF or VF driver.

To help resolve these concerns, we introduce a VF token into the VFIO
PCI ABI, which acts as a shared secret key between drivers.  The
userspace PF driver is required to set the VF token to a known value
and userspace VF drivers are required to provide the token to access
the VF device.  If a PF driver is restarted with VF drivers in use, it
must also provide the current token in order to prevent a rogue
untrusted PF driver from replacing a known driver.  The degree to
which this new token is considered secret is left to the userspace
drivers, the kernel intentionally provides no means to retrieve the
current token.

Note that the above token is only required for this new model where
both the PF and VF devices are usable through vfio-pci.  Existing
models of VFIO drivers where the PF is used without SR-IOV enabled
or the VF is bound to a userspace driver with an in-kernel, host PF
driver are unaffected.

The latter configuration above also highlights a new inverted scenario
that is now possible, a userspace PF driver with in-kernel VF drivers.
I believe this is a scenario that should be allowed, but should not be
enabled by default.  This series includes code to set a default
driver_override for VFs sourced from a vfio-pci user owned PF, such
that the VFs are also bound to vfio-pci.  This model is compatible
with tools like driverctl and allows the system administrator to
decide if other bindings should be enabled.  The VF token interface
above exists only between vfio-pci PF and VF drivers, once a VF is
bound to another driver, the administrator has effectively pronounced
the device as trusted.  The vfio-pci driver will note alternate
binding in dmesg for logging and debugging purposes.

Please review, comment, and test.  The example QEMU implementation
provided with the RFC is still current for this version.  Thanks,




Alex Williamson (7):
      vfio: Include optional device match in vfio_device_ops callbacks
      vfio/pci: Implement match ops
      vfio/pci: Introduce VF token
      vfio: Introduce VFIO_DEVICE_FEATURE ioctl and first user
      vfio/pci: Add sriov_configure support
      vfio/pci: Remove dev_fmt definition
      vfio/pci: Cleanup .probe() exit paths

 drivers/vfio/pci/vfio_pci.c         |  390 +++++++++++++++++++++++++++++++++--
 drivers/vfio/pci/vfio_pci_private.h |   10 +
 drivers/vfio/vfio.c                 |   20 +-
 include/linux/vfio.h                |    4 
 include/uapi/linux/vfio.h           |   37 +++
 5 files changed, 433 insertions(+), 28 deletions(-)

^ permalink raw reply	[flat|nested] 14+ messages in thread

end of thread, other threads:[~2020-03-19 17:47 UTC | newest]

Thread overview: 14+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-03-11 21:58 [PATCH v3 0/7] vfio/pci: SR-IOV support Alex Williamson
2020-03-11 21:58 ` [PATCH v3 1/7] vfio: Include optional device match in vfio_device_ops callbacks Alex Williamson
2020-03-11 21:58 ` [PATCH v3 2/7] vfio/pci: Implement match ops Alex Williamson
2020-03-11 21:58 ` [PATCH v3 3/7] vfio/pci: Introduce VF token Alex Williamson
2020-03-19 17:27   ` Cornelia Huck
2020-03-11 21:59 ` [PATCH v3 4/7] vfio: Introduce VFIO_DEVICE_FEATURE ioctl and first user Alex Williamson
2020-03-19 17:33   ` Cornelia Huck
2020-03-11 21:59 ` [PATCH v3 5/7] vfio/pci: Add sriov_configure support Alex Williamson
2020-03-19 17:44   ` Cornelia Huck
2020-03-11 21:59 ` [PATCH v3 6/7] vfio/pci: Remove dev_fmt definition Alex Williamson
2020-03-11 21:59 ` [PATCH v3 7/7] vfio/pci: Cleanup .probe() exit paths Alex Williamson
2020-03-19 17:46   ` Cornelia Huck
2020-03-19  6:32 ` [PATCH v3 0/7] vfio/pci: SR-IOV support Tian, Kevin
2020-03-19 13:11   ` Alex Williamson

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).