DescriptionAlex Williamson
2016-07-21 15:30:44 UTC
Description of problem:
A request has been made to make vfio no-iommu mode kernel modules available to NFV partners on RHEL7.2 through the "FD" channel. This mode currently exists in RHEL7.3 via bug 1299662. Importantly, this no-iommu mode is not supported and taints the kernel when used. The justification for providing it at all is that it's more detectable when it's used due to the kernel tainting and it promotes the vfio device interface which provides additional features, such as MSI/X interrupt support vs the UIO driver. However, vfio is a userspace driver interface which can only be considered secure when operating in conjunction with the protection of an iommu. This unsupported no-iommu mode is meant to bridge the gap for physical systems without an iommu as well as virtual machines where the interaction of a virtual iommu with a physical iommu is not sufficiently advanced to provide the necessary protection.
RHEL7.2 already includes vfio support in the base kernel, though of course not with this requested feature. The driver update would therefore need to replace the kernel delivered modules with these updates. Somehow these modules should only be approved for customer and partner use for this specific feature and not for general KVM device assignment as the driver update will not be qualified beyond the no-iommu use case.
Version-Release number of selected component (if applicable):
Latest rhel7.2.z kernel
How reproducible:
Steps to Reproduce:
1.
2.
3.
Actual results:
Expected results:
Additional info:
The goal is to get VFIO no-iommu to NFV vendors and partners so that they can validate DPDK VNF using RHEL for guest. Need to provide VFIO no-iommu kernel modules via Fast Datapath Beta channel till RHEL 7.3 becomes available.
VFIO no-iommu is not supported since it taints the guest kernel but provides more protection than *UIO* drivers.
RHEL host already supports VFIO with IOMMU providing secure DMA access for DPDK usecases
For DPDK guest, eventually when vIOMMU (worked on upstream) is available then RHEL guests can use VFIO vIOMMU which would provide secure DMA access
Comment 12Whitney Chadwick
2016-09-14 21:04:38 UTC