DPDK patches and discussions
 help / color / mirror / Atom feed
From: "Michael S. Tsirkin" <mst@redhat.com>
To: Avi Kivity <avi@scylladb.com>
Cc: "dev@dpdk.org" <dev@dpdk.org>
Subject: Re: [dpdk-dev] Having troubles binding an SR-IOV VF to uio_pci_generic on Amazon instance
Date: Wed, 30 Sep 2015 17:39:34 +0300	[thread overview]
Message-ID: <20150930165359-mutt-send-email-mst@redhat.com> (raw)
In-Reply-To: <560BDE24.8000308@scylladb.com>

On Wed, Sep 30, 2015 at 04:05:40PM +0300, Avi Kivity wrote:
> 
> 
> On 09/30/2015 03:27 PM, Michael S. Tsirkin wrote:
> >On Wed, Sep 30, 2015 at 03:16:04PM +0300, Vlad Zolotarov wrote:
> >>
> >>On 09/30/15 15:03, Michael S. Tsirkin wrote:
> >>>On Wed, Sep 30, 2015 at 02:53:19PM +0300, Vlad Zolotarov wrote:
> >>>>On 09/30/15 14:41, Michael S. Tsirkin wrote:
> >>>>>On Wed, Sep 30, 2015 at 02:26:01PM +0300, Vlad Zolotarov wrote:
> >>>>>>The whole idea is to bypass kernel. Especially for networking...
> >>>>>... on dumb hardware that doesn't support doing that securely.
> >>>>On a very capable HW that supports whatever security requirements needed
> >>>>(e.g. 82599 Intel's SR-IOV VF devices).
> >>>Network card type is irrelevant as long as you do not have an IOMMU,
> >>>otherwise you would just use e.g. VFIO.
> >>Sorry, but I don't follow your logic here - Amazon EC2 environment is a
> >>example where there *is* iommu but it's not virtualized
> >>and thus VFIO is
> >>useless and there is an option to use directly assigned SR-IOV networking
> >>device there where using the kernel drivers impose a performance impact
> >>compared to user space UIO-based user space kernel bypass mode of usage. How
> >>is it irrelevant? Could u, pls, clarify your point?
> >>
> >So it's not even dumb hardware, it's another piece of software
> >that forces an "all or nothing" approach where either
> >device has access to all VM memory, or none.
> >And this, unfortunately, leaves you with no secure way to
> >allow userspace drivers.
> 
> Some setups don't need security (they are single-user, single application).
> But do need a lot of performance (like 5X-10X performance).  An example is
> OpenVSwitch, security doesn't help it at all and if you force it to use the
> kernel drivers you cripple it.

We'd have to see there are actual users that need this.  So far, dpdk
seems like the only one, and it wants to use UIO for slow path stuff
like polling link status.  Why this needs kernel bypass support, I don't
know.  I asked, and got no answer.

> 
> Also, I'm root.  I can do anything I like, including loading a patched
> pci_uio_generic.  You're not providing _any_ security, you're simply making
> life harder for users.

Maybe that's true on your system. But I guess you know that's not true
for everyone, not in 2015.

> >So it makes even less sense to add insecure work-arounds in the kernel.
> >It seems quite likely that by the time the new kernel reaches
> >production X years from now, EC2 will have a virtual iommu.
> 
> I can adopt a new kernel tomorrow.  I have no influence on EC2.
> 
>

Xen grant tables sound like they could be the right interface
for EC2.  google search for "grant tables iommu" immediately gives me:
http://lists.xenproject.org/archives/html/xen-devel/2014-04/msg00963.html
Maybe latest Xen is already doing the right thing, and it's just the
question of making VFIO use that.

-- 
MST

  reply	other threads:[~2015-09-30 14:39 UTC|newest]

Thread overview: 100+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2015-09-27  7:05 Vlad Zolotarov
2015-09-27  9:43 ` Michael S. Tsirkin
2015-09-27 10:50   ` Vladislav Zolotarov
2015-09-29 16:41   ` Vlad Zolotarov
2015-09-29 20:54     ` Michael S. Tsirkin
2015-09-29 21:46       ` Stephen Hemminger
2015-09-29 21:49         ` Michael S. Tsirkin
2015-09-30 10:37           ` Vlad Zolotarov
2015-09-30 10:58             ` Michael S. Tsirkin
2015-09-30 11:26               ` Vlad Zolotarov
     [not found]                 ` <20150930143927-mutt-send-email-mst@redhat.com>
2015-09-30 11:53                   ` Vlad Zolotarov
2015-09-30 12:03                     ` Michael S. Tsirkin
2015-09-30 12:16                       ` Vlad Zolotarov
2015-09-30 12:27                         ` Michael S. Tsirkin
2015-09-30 12:50                           ` Vlad Zolotarov
2015-09-30 15:26                             ` Michael S. Tsirkin
2015-09-30 18:15                               ` Vlad Zolotarov
2015-09-30 18:55                                 ` Michael S. Tsirkin
2015-09-30 19:06                                   ` Vlad Zolotarov
2015-09-30 19:10                                     ` Vlad Zolotarov
2015-09-30 19:11                                       ` Vlad Zolotarov
2015-09-30 19:39                                     ` Michael S. Tsirkin
2015-09-30 20:09                                       ` Vlad Zolotarov
2015-09-30 21:36                                         ` Stephen Hemminger
2015-09-30 21:53                                           ` Michael S. Tsirkin
2015-09-30 22:20                                           ` Vlad Zolotarov
2015-10-01  8:00                                           ` Vlad Zolotarov
2015-10-01 14:47                                             ` Stephen Hemminger
2015-10-01 15:03                                               ` Vlad Zolotarov
2015-09-30 13:05                           ` Avi Kivity
2015-09-30 14:39                             ` Michael S. Tsirkin [this message]
2015-09-30 14:53                               ` Avi Kivity
2015-09-30 15:21                                 ` Michael S. Tsirkin
2015-09-30 15:36                                   ` Avi Kivity
2015-09-30 20:40                                     ` Michael S. Tsirkin
2015-09-30 21:00                                       ` Avi Kivity
2015-10-01  8:44                                       ` Michael S. Tsirkin
2015-10-01  8:46                                         ` Vlad Zolotarov
2015-10-01  8:52                                         ` Avi Kivity
2015-10-01  9:15                                           ` Michael S. Tsirkin
2015-10-01  9:22                                             ` Avi Kivity
2015-10-01  9:42                                               ` Michael S. Tsirkin
2015-10-01  9:53                                                 ` Avi Kivity
2015-10-01 10:17                                                   ` Michael S. Tsirkin
2015-10-01 10:24                                                     ` Avi Kivity
2015-10-01 10:25                                                       ` Avi Kivity
2015-10-01 10:44                                                         ` Michael S. Tsirkin
2015-10-01 10:55                                                           ` Avi Kivity
2015-10-01 21:17                                                 ` Alexander Duyck
2015-10-02 13:50                                                   ` Michael S. Tsirkin
2015-10-01  9:42                                               ` Vincent JARDIN
2015-10-01  9:43                                                 ` Avi Kivity
2015-10-01  9:48                                                   ` Vincent JARDIN
2015-10-01  9:54                                                     ` Avi Kivity
2015-10-01 10:14                                                   ` Michael S. Tsirkin
2015-10-01 10:23                                                     ` Avi Kivity
2015-10-01 14:55                                                     ` Stephen Hemminger
2015-10-01 15:49                                                       ` Michael S. Tsirkin
2015-10-01 14:54                                                 ` Stephen Hemminger
2015-10-01  9:55                                               ` Michael S. Tsirkin
2015-10-01  9:59                                                 ` Avi Kivity
2015-10-01 10:38                                                   ` Michael S. Tsirkin
2015-10-01 10:50                                                     ` Avi Kivity
2015-10-01 11:09                                                       ` Michael S. Tsirkin
2015-10-01 11:20                                                         ` Avi Kivity
2015-10-01 11:27                                                           ` Michael S. Tsirkin
2015-10-01 11:32                                                             ` Avi Kivity
2015-10-01 15:01                                                               ` Stephen Hemminger
2015-10-01 15:08                                                                 ` Avi Kivity
2015-10-01 15:46                                                                 ` Michael S. Tsirkin
2015-10-01 15:11                                                               ` Michael S. Tsirkin
2015-10-01 15:19                                                                 ` Avi Kivity
2015-10-01 15:40                                                                   ` Michael S. Tsirkin
2015-10-01 11:31                                                           ` Michael S. Tsirkin
2015-10-01 11:34                                                             ` Avi Kivity
2015-10-01 11:08                                                     ` Bruce Richardson
2015-10-01 11:23                                                       ` Michael S. Tsirkin
2015-10-01 12:07                                                         ` Bruce Richardson
2015-10-01 13:14                                                           ` Michael S. Tsirkin
2015-10-01 16:04                                                             ` Michael S. Tsirkin
2015-10-01 21:02                                                             ` Alexander Duyck
2015-10-02 14:00                                                               ` Michael S. Tsirkin
2015-10-02 14:07                                                                 ` Bruce Richardson
2015-10-04  9:07                                                                   ` Michael S. Tsirkin
2015-10-02 15:56                                                                 ` Gleb Natapov
2015-10-02 16:57                                                                 ` Alexander Duyck
2015-10-01  9:15                                           ` Avi Kivity
2015-10-01  9:29                                             ` Michael S. Tsirkin
2015-10-01  9:38                                               ` Avi Kivity
2015-10-01 10:07                                                 ` Michael S. Tsirkin
2015-10-01 10:11                                                   ` Avi Kivity
2015-10-01  9:16                                         ` Michael S. Tsirkin
2015-09-30 17:28             ` Stephen Hemminger
2015-09-30 17:39               ` Michael S. Tsirkin
2015-09-30 17:43                 ` Stephen Hemminger
2015-09-30 18:50                   ` Michael S. Tsirkin
2015-09-30 20:00                     ` Gleb Natapov
2015-09-30 20:36                       ` Michael S. Tsirkin
2015-10-01  5:04                         ` Gleb Natapov
2015-09-30 17:44                 ` Gleb Natapov

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20150930165359-mutt-send-email-mst@redhat.com \
    --to=mst@redhat.com \
    --cc=avi@scylladb.com \
    --cc=dev@dpdk.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).