From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id 8EEBCA0032; Fri, 24 Jun 2022 15:20:32 +0200 (CEST) Received: from [217.70.189.124] (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id 9055442B6F; Fri, 24 Jun 2022 15:20:13 +0200 (CEST) Received: from NAM11-DM6-obe.outbound.protection.outlook.com (mail-dm6nam11on2082.outbound.protection.outlook.com [40.107.223.82]) by mails.dpdk.org (Postfix) with ESMTP id 1D7E6427FF; Fri, 24 Jun 2022 15:20:10 +0200 (CEST) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=Rwusw5A9LcNHszVXdwBoOpIBsIg/6WOT0f137QTGxx+OA728cL4SFa8fsyDRhA6lVtEU5flQ2A4iU6RMnslG6I4KBJTOfCZlCHYyut4xmF6mZskImDYfyE9kX97gqxCPHMt13okQ6bc1MPcsnJR7+SNRTqX1qYZQz2xWh/wCgdFDqYvSAdcFa/OdiPLcOCuaDrHmNifupXuekUWQf0fy/Tcc4DM6XAzueHy75tpAdaktWK6xktIPNTRMGKJqclSOVbE+IIbgh2SaDuv5T5r25oibQrAI9U5t76g7Wa3v3lpGPpLsZNVKazZpyp+rb4oFgXEKaOLSBdAIFn2j55+hrA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=3PZsvV8UxwsCCg8Cj9IG54/SfJSnJ2wFglvspkVHfQs=; b=XiQNb2HG5jPYTxN1KjRMDsoU52MRC7p3TANM0TVXJ2oZhC/2FEYiFJ4gopdWP25yOOHA70/HqgxZ6lf7DPKtdgfc88Dbu8x/F5f3LmbMi2oFm8wz2RHv9n+W9vZdTGQdoYLpOOZ7lnt4tOy6dJaBUZbogZHdPi8q7O0q/ocnLCgZUNi85I/e/Wsr+9/5voSje9YZNpfewncWSuOqtbsTHfs+jsA9xs7RGBlWRhdAXuZ/f9oJcL6NSey5ZedpdRJl3sRpmoGgCOaTgiiHlMNG7LZ38+S7zeuo/JpXP7wjERa03pxhneGEfUJgQ0ln/65DXbkQKOzdwOEswty2CsjYiQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 12.22.5.238) smtp.rcpttodomain=dpdk.org smtp.mailfrom=nvidia.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=3PZsvV8UxwsCCg8Cj9IG54/SfJSnJ2wFglvspkVHfQs=; b=GVdG3qgF6ciSWFkEH51pDjcqsh99o+UFP6HjjujlY4rV+Qo/qGlKA7JCcCkhkO61VPxXpLMA4juvC1AUdJPaRDDO56Id++MXS2ZKpU48H7ctuCyG95qAwW0pZHCdTTMMdSu8Yz5Mwn29byWHCwd3mJlSUCLUrEbO2nJaFtMQbI5AZm0f/8tNumfBOaLLciunQeg4KSI4rwur4jpLolficVnHlpjy9yvH3H2T3f8qI+ZBDo23/bKGvY1j4xbfOZ6r4qr2HLTE8qtia9LvJPi1nLodUBfhL1hVV4Rc2U9PjbwcSXN+XO4TwPonxjywtFa8zTt5PSGU4VxW0HQzkoG++w== Received: from DS7PR05CA0096.namprd05.prod.outlook.com (2603:10b6:8:56::28) by MN2PR12MB3247.namprd12.prod.outlook.com (2603:10b6:208:ad::13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5353.20; Fri, 24 Jun 2022 13:20:07 +0000 Received: from DM6NAM11FT053.eop-nam11.prod.protection.outlook.com (2603:10b6:8:56:cafe::6c) by DS7PR05CA0096.outlook.office365.com (2603:10b6:8:56::28) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5395.6 via Frontend Transport; Fri, 24 Jun 2022 13:20:07 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 12.22.5.238) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 12.22.5.238 as permitted sender) receiver=protection.outlook.com; client-ip=12.22.5.238; helo=mail.nvidia.com; pr=C Received: from mail.nvidia.com (12.22.5.238) by DM6NAM11FT053.mail.protection.outlook.com (10.13.173.74) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.5373.15 via Frontend Transport; Fri, 24 Jun 2022 13:20:07 +0000 Received: from rnnvmail201.nvidia.com (10.129.68.8) by DRHQMAIL105.nvidia.com (10.27.9.14) with Microsoft SMTP Server (TLS) id 15.0.1497.32; Fri, 24 Jun 2022 13:20:06 +0000 Received: from rnnvmail204.nvidia.com (10.129.68.6) by rnnvmail201.nvidia.com (10.129.68.8) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.986.26; Fri, 24 Jun 2022 06:20:05 -0700 Received: from nvidia.com (10.127.8.11) by mail.nvidia.com (10.129.68.6) with Microsoft SMTP Server id 15.2.986.26 via Frontend Transport; Fri, 24 Jun 2022 06:20:05 -0700 From: Dmitry Kozlyuk To: CC: Subject: [PATCH v4 4/5] doc: update instructions for running as non-root for MLX5 Date: Fri, 24 Jun 2022 16:19:55 +0300 Message-ID: <20220624131956.75160-5-dkozlyuk@nvidia.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20220624131956.75160-1-dkozlyuk@nvidia.com> References: <20220624084817.63145-1-dkozlyuk@nvidia.com> <20220624131956.75160-1-dkozlyuk@nvidia.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: c1634801-5665-4896-c8a7-08da55e441ef X-MS-TrafficTypeDiagnostic: MN2PR12MB3247:EE_ X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: nPcyHXJ1REhq6l5caX72DiRNBmupMkMuMKUDu/HF5jCvK41GO+m6Q47mhT0GJzqidGcA3qt6M5A3dlPgAbLpZf8lylw2STdGjJ4E/3o71pZ6WZfRxgk3eDAHENwHFIzF0Kg8LXyBOEYTS8NYsTB0xcEqMlgumvoewjRA742e6/iNcOd0P7zKhF+yrwzhVKKd2z6AGwBo0VUhIhW5a6WcZdYT8M7xzckdWzHjGWD2wBrZfm7NGIT6UF03fjGNKTuhMj0Frtyy9T3FQWEbVoGi//RvBu6Oho2OqjkKKwgjlnPbLivouR2Z6yLHBt1SOsg8BfttPyvyxC63ZSHwVp1ObLABsAWb6Np4JqY2GMSi9IeOPnXHOm5Bazo2siAyKEl6w/f3tv6cZlAU2pR/goqNlzCNVeGbp3nBIpo1EgLkVK5Ask+f539gsNbyMH6/285R/zi9gr/rDkqov0lxzOtXviQhucUHNC+kNpzxWvbCv/KIAK7PZWnGhvI5tMpRZo+zxwELskDi0E+jz62TQpJ+CaAV/Z8If5l4kv1MWxgvbjTK5egyLTUpu1RqxrHbNX3MgkwWVMUUCguH9U3mpj8sRCaNdjnTybfgEUHU/8u7AT3XK53ZGu2iFz81WnqGNTMoHp+vg2fvRtjPgeUkL47/kkJ0leMgY1QILuAxoeD9OKDVdeInNWSLbU7wGQF071zck2xUQtKd+ugaU7CJmqTd6zS0FgXTRrKbZNaUkoednsKVDov1sKiqSaTBl6rrbyuHQGweWc93/Uoeqx2XpCkBvSPhlFE+L+Ia/cVqJZ6/lx0z9PzTWwbdJaDXOjcO8dX1VhIDLg9JdMH7opw45QmjYg== X-Forefront-Antispam-Report: CIP:12.22.5.238; CTRY:US; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:mail.nvidia.com; PTR:InfoNoRecords; CAT:NONE; SFS:(13230016)(4636009)(346002)(136003)(39860400002)(376002)(396003)(40470700004)(36840700001)(46966006)(6666004)(2616005)(186003)(2906002)(26005)(7696005)(426003)(47076005)(82310400005)(316002)(6916009)(36756003)(86362001)(55016003)(41300700001)(1076003)(8676002)(8936002)(336012)(83380400001)(70206006)(81166007)(6286002)(40480700001)(478600001)(36860700001)(450100002)(356005)(4326008)(5660300002)(70586007)(82740400003)(40460700003)(36900700001); DIR:OUT; SFP:1101; X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 24 Jun 2022 13:20:07.2390 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: c1634801-5665-4896-c8a7-08da55e441ef X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a; Ip=[12.22.5.238]; Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: DM6NAM11FT053.eop-nam11.prod.protection.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: MN2PR12MB3247 X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Reference the common guide for generic setup. Remove excessive capabilities from the recommended list. Cc: stable@dpdk.org Signed-off-by: Dmitry Kozlyuk --- doc/guides/platform/mlx5.rst | 31 ++++++++++++++++++------------- 1 file changed, 18 insertions(+), 13 deletions(-) diff --git a/doc/guides/platform/mlx5.rst b/doc/guides/platform/mlx5.rst index 64a4c5e76e..18d38f3488 100644 --- a/doc/guides/platform/mlx5.rst +++ b/doc/guides/platform/mlx5.rst @@ -404,25 +404,30 @@ The device can be bound again at this point. Run as Non-Root ^^^^^^^^^^^^^^^ -In order to run as a non-root user, -some capabilities must be granted to the application:: +Hugepage and resource limit setup are documented +in the :ref:`common Linux guide `. +This PMD can operate without access to physical addresses, +therefore it does not require ``SYS_ADMIN`` to access ``/proc/self/pagemaps``. +Note that this requirement may still come from other drivers. - setcap cap_sys_admin,cap_net_admin,cap_net_raw,cap_ipc_lock+ep +Below are additional capabilities that must be granted to the application +with the reasons for the need of each capability: -Below are the reasons for the need of each capability: +``NET_RAW`` + For raw Ethernet queue allocation through the kernel driver. -``cap_sys_admin`` - When using physical addresses (PA mode), with Linux >= 4.0, - for access to ``/proc/self/pagemap``. +``NET_ADMIN`` + For device configuration, like setting link status or MTU. -``cap_net_admin`` - For device configuration. +``SYS_RAWIO`` + For using group 1 and above (software steering) in Flow API. -``cap_net_raw`` - For raw ethernet queue allocation through kernel driver. +They can be manually granted for a specific executable file:: -``cap_ipc_lock`` - For DMA memory pinning. + setcap cap_net_raw,cap_net_admin,cap_sys_rawio+ep + +Alternatively, a service manager or a container runtime +may configure the capabilities for a process. Windows Environment -- 2.25.1