Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/patches/77706/?format=api
{ "id": 77706, "url": "http://patches.dpdk.org/api/patches/77706/?format=api", "web_url": "http://patches.dpdk.org/project/dpdk/patch/20200915111459.456-2-adamx.dybkowski@intel.com/", "project": { "id": 1, "url": "http://patches.dpdk.org/api/projects/1/?format=api", "name": "DPDK", "link_name": "dpdk", "list_id": "dev.dpdk.org", "list_email": "dev@dpdk.org", "web_url": "http://core.dpdk.org", "scm_url": "git://dpdk.org/dpdk", "webscm_url": "http://git.dpdk.org/dpdk", "list_archive_url": "https://inbox.dpdk.org/dev", "list_archive_url_format": "https://inbox.dpdk.org/dev/{}", "commit_url_format": "" }, "msgid": "<20200915111459.456-2-adamx.dybkowski@intel.com>", "list_archive_url": "https://inbox.dpdk.org/dev/20200915111459.456-2-adamx.dybkowski@intel.com", "date": "2020-09-15T11:14:59", "name": "[v3,1/1] doc: document vfio-pci usage with QAT PMD", "commit_ref": null, "pull_url": null, "state": "superseded", "archived": true, "hash": "f2a72947c99a44583ad792e56b6bd298cea8940b", "submitter": { "id": 1322, "url": "http://patches.dpdk.org/api/people/1322/?format=api", "name": "Dybkowski, AdamX", "email": "adamx.dybkowski@intel.com" }, "delegate": { "id": 6690, "url": "http://patches.dpdk.org/api/users/6690/?format=api", "username": "akhil", "first_name": "akhil", "last_name": "goyal", "email": "gakhil@marvell.com" }, "mbox": "http://patches.dpdk.org/project/dpdk/patch/20200915111459.456-2-adamx.dybkowski@intel.com/mbox/", "series": [ { "id": 12229, "url": "http://patches.dpdk.org/api/series/12229/?format=api", "web_url": "http://patches.dpdk.org/project/dpdk/list/?series=12229", "date": "2020-09-15T11:14:58", "name": "doc: document vfio-pci usage with QAT PMD", "version": 3, "mbox": "http://patches.dpdk.org/series/12229/mbox/" } ], "comments": "http://patches.dpdk.org/api/patches/77706/comments/", "check": "success", "checks": "http://patches.dpdk.org/api/patches/77706/checks/", "tags": {}, "related": [], "headers": { "Return-Path": "<dev-bounces@dpdk.org>", "X-Original-To": "patchwork@inbox.dpdk.org", "Delivered-To": "patchwork@inbox.dpdk.org", "Received": [ "from dpdk.org (dpdk.org [92.243.14.124])\n\tby inbox.dpdk.org (Postfix) with ESMTP id D63E6A04C7;\n\tTue, 15 Sep 2020 13:15:13 +0200 (CEST)", "from [92.243.14.124] (localhost [127.0.0.1])\n\tby dpdk.org (Postfix) with ESMTP id E27F41C0C2;\n\tTue, 15 Sep 2020 13:15:06 +0200 (CEST)", "from mga11.intel.com (mga11.intel.com [192.55.52.93])\n by dpdk.org (Postfix) with ESMTP id 547EDE07\n for <dev@dpdk.org>; Tue, 15 Sep 2020 13:15:04 +0200 (CEST)", "from orsmga002.jf.intel.com ([10.7.209.21])\n by fmsmga102.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384;\n 15 Sep 2020 04:15:03 -0700", "from unknown (HELO adamdybx-MOBL.ger.corp.intel.com)\n ([10.104.113.51])\n by orsmga002.jf.intel.com with ESMTP; 15 Sep 2020 04:15:02 -0700" ], "IronPort-SDR": [ "\n 2uhb2/EUzgzs3/WyuBHxMY1kiLEHwaVZ9ATMcxz11FFoxEOt/xhSicLgUBQorddkrlG2CGNRvX\n swevt7kz4w2w==", "\n NsfvhHMoyfQOHJ6dS/FKk4xTCBVt76NTgsKBB6MFe/YCSQfucUm27eG0KtxMlaNQE1El10yTw2\n 6u+/S3htJBJg==" ], "X-IronPort-AV": [ "E=McAfee;i=\"6000,8403,9744\"; a=\"156666205\"", "E=Sophos;i=\"5.76,429,1592895600\"; d=\"scan'208\";a=\"156666205\"", "E=Sophos;i=\"5.76,429,1592895600\"; d=\"scan'208\";a=\"319390366\"" ], "X-Amp-Result": "SKIPPED(no attachment in message)", "X-Amp-File-Uploaded": "False", "X-ExtLoop1": "1", "From": "Adam Dybkowski <adamx.dybkowski@intel.com>", "To": "fiona.trahe@intel.com, akhil.goyal@nxp.com, dev@dpdk.org,\n anatoly.burakov@intel.com", "Cc": "Adam Dybkowski <adamx.dybkowski@intel.com>", "Date": "Tue, 15 Sep 2020 13:14:59 +0200", "Message-Id": "<20200915111459.456-2-adamx.dybkowski@intel.com>", "X-Mailer": "git-send-email 2.25.1", "In-Reply-To": "<20200915111459.456-1-adamx.dybkowski@intel.com>", "References": "<20200908161950.601-1-adamx.dybkowski@intel.com>\n <20200915111459.456-1-adamx.dybkowski@intel.com>", "MIME-Version": "1.0", "Content-Transfer-Encoding": "8bit", "Subject": "[dpdk-dev] [PATCH v3 1/1] doc: document vfio-pci usage with QAT PMD", "X-BeenThere": "dev@dpdk.org", "X-Mailman-Version": "2.1.15", "Precedence": "list", "List-Id": "DPDK patches and discussions <dev.dpdk.org>", "List-Unsubscribe": "<https://mails.dpdk.org/options/dev>,\n <mailto:dev-request@dpdk.org?subject=unsubscribe>", "List-Archive": "<http://mails.dpdk.org/archives/dev/>", "List-Post": "<mailto:dev@dpdk.org>", "List-Help": "<mailto:dev-request@dpdk.org?subject=help>", "List-Subscribe": "<https://mails.dpdk.org/listinfo/dev>,\n <mailto:dev-request@dpdk.org?subject=subscribe>", "Errors-To": "dev-bounces@dpdk.org", "Sender": "\"dev\" <dev-bounces@dpdk.org>" }, "content": "This patch marks the old igb_uio driver as unsecure when used\nwith the QAT PMD and updates all examples to recommend using\nvfio-pci instead.\nIt also mentions security issues with the QAT CPM and provides\ninformation about the new vfio-pci parameter 'disable_denylist'\navailable in Linux kernels 5.9 and later.\n\nSigned-off-by: Adam Dybkowski <adamx.dybkowski@intel.com>\n---\n doc/guides/cryptodevs/qat.rst | 63 +++++++++++++++++++----------------\n 1 file changed, 34 insertions(+), 29 deletions(-)", "diff": "diff --git a/doc/guides/cryptodevs/qat.rst b/doc/guides/cryptodevs/qat.rst\nindex e5d2cf499..dbbdec1c7 100644\n--- a/doc/guides/cryptodevs/qat.rst\n+++ b/doc/guides/cryptodevs/qat.rst\n@@ -462,7 +462,7 @@ Check that the VFs are available for use. For example ``lspci -d:37c9`` should\n list 48 VF devices available for a ``C62x`` device.\n \n To complete the installation follow the instructions in\n-`Binding the available VFs to the DPDK UIO driver`_.\n+`Binding the available VFs to the vfio-pci driver`_.\n \n .. Note::\n \n@@ -534,7 +534,8 @@ Confirm the presence of 48 VF devices - 16 per PF::\n lspci -d:37c9\n \n \n-To complete the installation - follow instructions in `Binding the available VFs to the DPDK UIO driver`_.\n+To complete the installation - follow instructions in\n+`Binding the available VFs to the vfio-pci driver`_.\n \n .. Note::\n \n@@ -584,10 +585,21 @@ To complete the installation - follow instructions in `Binding the available VFs\n sudo yum install kernel-devel-`uname -r`\n \n \n-Binding the available VFs to the DPDK UIO driver\n+Binding the available VFs to the vfio-pci driver\n ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n \n-Unbind the VFs from the stock driver so they can be bound to the uio driver.\n+Note:\n+\n+* Please note that due to security issues, the usage of older DPDK igb_uio\n+ driver is not recommended. This document shows how to use the more secure\n+ vfio-pci driver.\n+* If QAT fails to bind to vfio-pci on Linux kernel 5.9+, please see the\n+ QATE-39220 and QATE-7495 issues in\n+ `01.org doc <https://01.org/sites/default/files/downloads/336211-015-qatsoftwareforlinux-rn-hwv1.7-final.pdf>`_\n+ which details the constraint about trusted guests and add `disable_denylist=1`\n+ to the vfio-pci params to use QAT. See also `this patch description <https://lkml.org/lkml/2020/7/23/1155>`_.\n+\n+Unbind the VFs from the stock driver so they can be bound to the vfio-pci driver.\n \n For an Intel(R) QuickAssist Technology DH895xCC device\n ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n@@ -595,10 +607,10 @@ For an Intel(R) QuickAssist Technology DH895xCC device\n The unbind command below assumes ``BDFs`` of ``03:01.00-03:04.07``, if your\n VFs are different adjust the unbind command below::\n \n+ cd to the top-level DPDK directory\n for device in $(seq 1 4); do \\\n for fn in $(seq 0 7); do \\\n- echo -n 0000:03:0${device}.${fn} > \\\n- /sys/bus/pci/devices/0000\\:03\\:0${device}.${fn}/driver/unbind; \\\n+ usertools/dpdk-devbind.py -u 0000:03:0${device}.${fn}; \\\n done; \\\n done\n \n@@ -609,16 +621,12 @@ The unbind command below assumes ``BDFs`` of ``1a:01.00-1a:02.07``,\n ``3d:01.00-3d:02.07`` and ``3f:01.00-3f:02.07``, if your VFs are different\n adjust the unbind command below::\n \n+ cd to the top-level DPDK directory\n for device in $(seq 1 2); do \\\n for fn in $(seq 0 7); do \\\n- echo -n 0000:1a:0${device}.${fn} > \\\n- /sys/bus/pci/devices/0000\\:1a\\:0${device}.${fn}/driver/unbind; \\\n-\n- echo -n 0000:3d:0${device}.${fn} > \\\n- /sys/bus/pci/devices/0000\\:3d\\:0${device}.${fn}/driver/unbind; \\\n-\n- echo -n 0000:3f:0${device}.${fn} > \\\n- /sys/bus/pci/devices/0000\\:3f\\:0${device}.${fn}/driver/unbind; \\\n+ usertools/dpdk-devbind.py -u 0000:1a:0${device}.${fn}; \\\n+ usertools/dpdk-devbind.py -u 0000:3d:0${device}.${fn}; \\\n+ usertools/dpdk-devbind.py -u 0000:3f:0${device}.${fn}; \\\n done; \\\n done\n \n@@ -628,32 +636,29 @@ For Intel(R) QuickAssist Technology C3xxx or 200xx or D15xx device\n The unbind command below assumes ``BDFs`` of ``01:01.00-01:02.07``, if your\n VFs are different adjust the unbind command below::\n \n+ cd to the top-level DPDK directory\n for device in $(seq 1 2); do \\\n for fn in $(seq 0 7); do \\\n- echo -n 0000:01:0${device}.${fn} > \\\n- /sys/bus/pci/devices/0000\\:01\\:0${device}.${fn}/driver/unbind; \\\n+ usertools/dpdk-devbind.py -u 0000:01:0${device}.${fn}; \\\n done; \\\n done\n \n-Bind to the DPDK uio driver\n+Bind to the vfio-pci driver\n ^^^^^^^^^^^^^^^^^^^^^^^^^^^\n \n-Install the DPDK igb_uio driver, bind the VF PCI Device id to it and use lspci\n-to confirm the VF devices are now in use by igb_uio kernel driver,\n+Load the vfio-pci driver, bind the VF PCI Device id to it using the\n+``dpdk-devbind.py`` script then use the ``--status`` option\n+to confirm the VF devices are now in use by vfio-pci kernel driver,\n e.g. for the C62x device::\n \n cd to the top-level DPDK directory\n- modprobe uio\n- insmod ./build/kmod/igb_uio.ko\n- echo \"8086 37c9\" > /sys/bus/pci/drivers/igb_uio/new_id\n- lspci -vvd:37c9\n-\n+ modprobe vfio-pci\n+ usertools/dpdk-devbind.py -b vfio-pci 0000:03:01.1\n+ usertools/dpdk-devbind.py --status\n \n-Another way to bind the VFs to the DPDK UIO driver is by using the\n-``dpdk-devbind.py`` script::\n-\n- cd to the top-level DPDK directory\n- ./usertools/dpdk-devbind.py -b igb_uio 0000:03:01.1\n+Use ``modprobe vfio-pci disable_denylist=1`` from kernel 5.9 onwards.\n+See note in the section `Binding the available VFs to the vfio-pci driver`_\n+above.\n \n Testing\n ~~~~~~~\n", "prefixes": [ "v3", "1/1" ] }