search for: monolit

...o there - but it's possible. This will absolutely address guests that don't need to set up IOMMU for virtio devices, and virtio that bypasses the IOMMU. But the problem is that we do want to *allow* guests to set up IOMMU for virtio devices. In that case, these are two other usecases: A- monolitic virtio within QEMU: iommu only needed for VFIO -> guest should always use iommu=pt iommu=on works but is just useless overhead. B- modular out of process virtio outside QEMU: iommu needed for VFIO or kernel driver -> guest should use iommu=pt or iommu=on depending on security/...

...o there - but it's possible. This will absolutely address guests that don't need to set up IOMMU for virtio devices, and virtio that bypasses the IOMMU. But the problem is that we do want to *allow* guests to set up IOMMU for virtio devices. In that case, these are two other usecases: A- monolitic virtio within QEMU: iommu only needed for VFIO -> guest should always use iommu=pt iommu=on works but is just useless overhead. B- modular out of process virtio outside QEMU: iommu needed for VFIO or kernel driver -> guest should use iommu=pt or iommu=on depending on security/...

...e arch-specific code for i386 and x86-64; other architectures are going to need some minor cleanup in setup.c or the equvalent. The current git tree includes a number of utilities, like dash (sh), which aren't used by the default kinit configuration. Additionally, right now kinit is built monolitically, in other words there isn't a CONFIG_ option to turn off nfsmount, for example. Again, I'm more than willing to put the tree in any particular state that makes sense. 3. Path: it probably would make sense to push this into -mm first? It's taken this long, I'd like to ma...

...This will absolutely address guests that don't need to set up IOMMU for > virtio devices, and virtio that bypasses the IOMMU. > > But the problem is that we do want to *allow* guests > to set up IOMMU for virtio devices. > In that case, these are two other usecases: > > A- monolitic virtio within QEMU: > iommu only needed for VFIO -> > guest should always use iommu=pt > iommu=on works but is just useless overhead. > > B- modular out of process virtio outside QEMU: > iommu needed for VFIO or kernel driver -> >...

...s that don't need to set up IOMMU for > > virtio devices, and virtio that bypasses the IOMMU. > > > > But the problem is that we do want to *allow* guests > > to set up IOMMU for virtio devices. > > In that case, these are two other usecases: > > > > A- monolitic virtio within QEMU: > > iommu only needed for VFIO -> > > guest should always use iommu=pt > > iommu=on works but is just useless overhead. > > > > B- modular out of process virtio outside QEMU: > > iommu needed for VFIO or ke...

...s that don't need to set up IOMMU for > > virtio devices, and virtio that bypasses the IOMMU. > > > > But the problem is that we do want to *allow* guests > > to set up IOMMU for virtio devices. > > In that case, these are two other usecases: > > > > A- monolitic virtio within QEMU: > > iommu only needed for VFIO -> > > guest should always use iommu=pt > > iommu=on works but is just useless overhead. > > > > B- modular out of process virtio outside QEMU: > > iommu needed for VFIO or ke...

...he end of the world at all, there are not that many virtio drivers. And hey - that's just an internal API. We can change it later at a whim. Long answer - PV is weird. It's not always the same as real hardware. For PV, it's generally hypervisor doing writes into memory. If it's monolitic with device emulation in same memory space as the hypervisor (e.g. in the case of the current QEMU, or using vhost in host kernel), then you gain *no security* by "restricting" it by means of the IOMMU - the IOMMU is part of the same hypervisor. If it is modular with device emulation i...

...he end of the world at all, there are not that many virtio drivers. And hey - that's just an internal API. We can change it later at a whim. Long answer - PV is weird. It's not always the same as real hardware. For PV, it's generally hypervisor doing writes into memory. If it's monolitic with device emulation in same memory space as the hypervisor (e.g. in the case of the current QEMU, or using vhost in host kernel), then you gain *no security* by "restricting" it by means of the IOMMU - the IOMMU is part of the same hypervisor. If it is modular with device emulation i...

On Wed, Oct 28, 2015 at 05:09:47PM +0900, David Woodhouse wrote: > On Wed, 2015-10-28 at 16:40 +0900, Christian Borntraeger wrote: > > Am 28.10.2015 um 16:17 schrieb Michael S. Tsirkin: > > > On Tue, Oct 27, 2015 at 11:38:57PM -0700, Andy Lutomirski wrote: > > > > This switches virtio to use the DMA API unconditionally. I'm sure > > > > it breaks

On Wed, Oct 28, 2015 at 05:09:47PM +0900, David Woodhouse wrote: > On Wed, 2015-10-28 at 16:40 +0900, Christian Borntraeger wrote: > > Am 28.10.2015 um 16:17 schrieb Michael S. Tsirkin: > > > On Tue, Oct 27, 2015 at 11:38:57PM -0700, Andy Lutomirski wrote: > > > > This switches virtio to use the DMA API unconditionally. I'm sure > > > > it breaks

...up IOMMU for >> > virtio devices, and virtio that bypasses the IOMMU. >> > >> > But the problem is that we do want to *allow* guests >> > to set up IOMMU for virtio devices. >> > In that case, these are two other usecases: >> > >> > A- monolitic virtio within QEMU: >> > iommu only needed for VFIO -> >> > guest should always use iommu=pt >> > iommu=on works but is just useless overhead. >> > >> > B- modular out of process virtio outside QEMU: >> > iom...

On Thu, Oct 29, 2015 at 05:18:56PM +0100, David Woodhouse wrote: > On Thu, 2015-10-29 at 11:01 +0200, Michael S. Tsirkin wrote: > > > > Example: you have a mix of assigned devices and virtio devices. You > > don't trust your assigned device vendor not to corrupt your memory so > > you want to limit the damage your assigned device can do to your > > guest, >

On Thu, Oct 29, 2015 at 05:18:56PM +0100, David Woodhouse wrote: > On Thu, 2015-10-29 at 11:01 +0200, Michael S. Tsirkin wrote: > > > > Example: you have a mix of assigned devices and virtio devices. You > > don't trust your assigned device vendor not to corrupt your memory so > > you want to limit the damage your assigned device can do to your > > guest, >

...again. Seriously? > FWIW: I actually think the LLVM community ratholes on a lot of things, *way too much*. Not sure we are quite at that point yet on this. > > I *personally* don't care if we use GitHub, or GitLab, Git or > mercurial. I don't care if we have sub-modules or a monolithic > repository, but I'm not the only user. > > LLVM has, so far, taken the modular approach that other projects can > embed our projects on their products. Downstream commercial products > do that, other OSS projects do that, and that's pretty cool. > > GCC has had a *...