From: Andre Richter <andre.o.richter@gmail.com>
To: "Burakov, Anatoly" <anatoly.burakov@intel.com>,
Stephen Hemminger <stephen@networkplumber.org>
Cc: "dev@dpdk.org" <dev@dpdk.org>
Subject: Re: [dpdk-dev] VFIO in setup.sh
Date: Tue, 31 Mar 2015 09:26:13 +0000 [thread overview]
Message-ID: <CAKqeN2-vJpvjAL2gj=M=arkZmDz+1UmTbiSngixSkq2uCQQXgg@mail.gmail.com> (raw)
In-Reply-To: <C6ECDF3AB251BE4894318F4E4512369780C7A59F@IRSMSX109.ger.corp.intel.com>
I think the whole process of VFIO binding maybe needs at least a second
thought regarding corner cases and security.
1) in the setup process, there currently is no mechanism that checks if the
Device to be used has other devices in the same iommu group that need to be
bound to VFIO too. Otherwise using VFIO will fail.
I think currently, it only works if the network device is the only one in
its iommu group.
2) Right now everything inside /dev/vfio/ is granted to the all users,
right? Maybe this leads to (security) issues if VFIO is in active use by
other non-dpdk processes for other PCIe devices.
Cheers,
Andre
Burakov, Anatoly <anatoly.burakov@intel.com> schrieb am Di., 31. März 2015
um 11:05:
> > > 3. Why depend on location of vfio module in kernel tree?
> > > modprobe does the right thing and finds it.
> > >
> > > VFIO_PATH="kernel/drivers/vfio/pci/vfio-pci.ko"
> > >
> > > echo "Loading VFIO module"
> > > /sbin/lsmod | grep -s vfio_pci > /dev/null
> > > if [ $? -ne 0 ] ; then
> > > if [ -f /lib/modules/$(uname -r)/$VFIO_PATH ] ; then
> > > sudo /sbin/modprobe vfio-pci
> > > fi
> > > fi
> > >
>
> Here I agree. Needs to be fixed.
>
> Thanks,
> Anatoly
>
next prev parent reply other threads:[~2015-03-31 9:26 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-03-30 20:35 Stephen Hemminger
2015-03-30 20:37 ` Stephen Hemminger
2015-03-31 9:05 ` Burakov, Anatoly
2015-03-31 9:26 ` Andre Richter [this message]
2015-03-31 9:35 ` Burakov, Anatoly
2015-03-31 12:41 ` Andre Richter
2015-03-31 12:59 ` Burakov, Anatoly
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAKqeN2-vJpvjAL2gj=M=arkZmDz+1UmTbiSngixSkq2uCQQXgg@mail.gmail.com' \
--to=andre.o.richter@gmail.com \
--cc=anatoly.burakov@intel.com \
--cc=dev@dpdk.org \
--cc=stephen@networkplumber.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).