Description of problem:

A request has been made to make vfio no-iommu mode kernel modules available to NFV partners on RHEL7.2 through the "FD" channel.  This mode currently exists in RHEL7.3 via bug 1299662.  Importantly, this no-iommu mode is not supported and taints the kernel when used.  The justification for providing it at all is that it's more detectable when it's used due to the kernel tainting and it promotes the vfio device interface which provides additional features, such as MSI/X interrupt support vs the UIO driver.  However, vfio is a userspace driver interface which can only be considered secure when operating in conjunction with the protection of an iommu.  This unsupported no-iommu mode is meant to bridge the gap for physical systems without an iommu as well as virtual machines where the interaction of a virtual iommu with a physical iommu is not sufficiently advanced to provide the necessary protection.

RHEL7.2 already includes vfio support in the base kernel, though of course not with this requested feature.  The driver update would therefore need to replace the kernel delivered modules with these updates.  Somehow these modules should only be approved for customer and partner use for this specific feature and not for general KVM device assignment as the driver update will not be qualified beyond the no-iommu use case.

Version-Release number of selected component (if applicable):
Latest rhel7.2.z kernel

How reproducible:


Steps to Reproduce:
1.
2.
3.

Actual results:


Expected results:


Additional info: