search for: monolitic

...o there - but it's possible. This will absolutely address guests that don't need to set up IOMMU for virtio devices, and virtio that bypasses the IOMMU. But the problem is that we do want to *allow* guests to set up IOMMU for virtio devices. In that case, these are two other usecases: A- monolitic virtio within QEMU: iommu only needed for VFIO -> guest should always use iommu=pt iommu=on works but is just useless overhead. B- modular out of process virtio outside QEMU: iommu needed for VFIO or kernel driver -> guest should use iommu=pt or iommu=on depending on security/pe...

...o there - but it's possible. This will absolutely address guests that don't need to set up IOMMU for virtio devices, and virtio that bypasses the IOMMU. But the problem is that we do want to *allow* guests to set up IOMMU for virtio devices. In that case, these are two other usecases: A- monolitic virtio within QEMU: iommu only needed for VFIO -> guest should always use iommu=pt iommu=on works but is just useless overhead. B- modular out of process virtio outside QEMU: iommu needed for VFIO or kernel driver -> guest should use iommu=pt or iommu=on depending on security/pe...

...e arch-specific code for i386 and x86-64; other architectures are going to need some minor cleanup in setup.c or the equvalent. The current git tree includes a number of utilities, like dash (sh), which aren't used by the default kinit configuration. Additionally, right now kinit is built monolitically, in other words there isn't a CONFIG_ option to turn off nfsmount, for example. Again, I'm more than willing to put the tree in any particular state that makes sense. 3. Path: it probably would make sense to push this into -mm first? It's taken this long, I'd like to make...

...This will absolutely address guests that don't need to set up IOMMU for > virtio devices, and virtio that bypasses the IOMMU. > > But the problem is that we do want to *allow* guests > to set up IOMMU for virtio devices. > In that case, these are two other usecases: > > A- monolitic virtio within QEMU: > iommu only needed for VFIO -> > guest should always use iommu=pt > iommu=on works but is just useless overhead. > > B- modular out of process virtio outside QEMU: > iommu needed for VFIO or kernel driver -> > g...

...s that don't need to set up IOMMU for > > virtio devices, and virtio that bypasses the IOMMU. > > > > But the problem is that we do want to *allow* guests > > to set up IOMMU for virtio devices. > > In that case, these are two other usecases: > > > > A- monolitic virtio within QEMU: > > iommu only needed for VFIO -> > > guest should always use iommu=pt > > iommu=on works but is just useless overhead. > > > > B- modular out of process virtio outside QEMU: > > iommu needed for VFIO or kern...

...s that don't need to set up IOMMU for > > virtio devices, and virtio that bypasses the IOMMU. > > > > But the problem is that we do want to *allow* guests > > to set up IOMMU for virtio devices. > > In that case, these are two other usecases: > > > > A- monolitic virtio within QEMU: > > iommu only needed for VFIO -> > > guest should always use iommu=pt > > iommu=on works but is just useless overhead. > > > > B- modular out of process virtio outside QEMU: > > iommu needed for VFIO or kern...

...he end of the world at all, there are not that many virtio drivers. And hey - that's just an internal API. We can change it later at a whim. Long answer - PV is weird. It's not always the same as real hardware. For PV, it's generally hypervisor doing writes into memory. If it's monolitic with device emulation in same memory space as the hypervisor (e.g. in the case of the current QEMU, or using vhost in host kernel), then you gain *no security* by "restricting" it by means of the IOMMU - the IOMMU is part of the same hypervisor. If it is modular with device emulation in...

...he end of the world at all, there are not that many virtio drivers. And hey - that's just an internal API. We can change it later at a whim. Long answer - PV is weird. It's not always the same as real hardware. For PV, it's generally hypervisor doing writes into memory. If it's monolitic with device emulation in same memory space as the hypervisor (e.g. in the case of the current QEMU, or using vhost in host kernel), then you gain *no security* by "restricting" it by means of the IOMMU - the IOMMU is part of the same hypervisor. If it is modular with device emulation in...

On Wed, Oct 28, 2015 at 05:09:47PM +0900, David Woodhouse wrote: > On Wed, 2015-10-28 at 16:40 +0900, Christian Borntraeger wrote: > > Am 28.10.2015 um 16:17 schrieb Michael S. Tsirkin: > > > On Tue, Oct 27, 2015 at 11:38:57PM -0700, Andy Lutomirski wrote: > > > > This switches virtio to use the DMA API unconditionally. I'm sure > > > > it breaks

On Wed, Oct 28, 2015 at 05:09:47PM +0900, David Woodhouse wrote: > On Wed, 2015-10-28 at 16:40 +0900, Christian Borntraeger wrote: > > Am 28.10.2015 um 16:17 schrieb Michael S. Tsirkin: > > > On Tue, Oct 27, 2015 at 11:38:57PM -0700, Andy Lutomirski wrote: > > > > This switches virtio to use the DMA API unconditionally. I'm sure > > > > it breaks

...up IOMMU for >> > virtio devices, and virtio that bypasses the IOMMU. >> > >> > But the problem is that we do want to *allow* guests >> > to set up IOMMU for virtio devices. >> > In that case, these are two other usecases: >> > >> > A- monolitic virtio within QEMU: >> > iommu only needed for VFIO -> >> > guest should always use iommu=pt >> > iommu=on works but is just useless overhead. >> > >> > B- modular out of process virtio outside QEMU: >> > iommu...

On Thu, Oct 29, 2015 at 05:18:56PM +0100, David Woodhouse wrote: > On Thu, 2015-10-29 at 11:01 +0200, Michael S. Tsirkin wrote: > > > > Example: you have a mix of assigned devices and virtio devices. You > > don't trust your assigned device vendor not to corrupt your memory so > > you want to limit the damage your assigned device can do to your > > guest, >

On Thu, Oct 29, 2015 at 05:18:56PM +0100, David Woodhouse wrote: > On Thu, 2015-10-29 at 11:01 +0200, Michael S. Tsirkin wrote: > > > > Example: you have a mix of assigned devices and virtio devices. You > > don't trust your assigned device vendor not to corrupt your memory so > > you want to limit the damage your assigned device can do to your > > guest, >

On Wed, Jul 20, 2016 at 6:18 PM, Renato Golin <renato.golin at linaro.org> wrote: > On 21 July 2016 at 02:06, Daniel Berlin <dberlin at dberlin.org> wrote: > >> Checking out all of it is bad, > > > > Define bad? > > Time? > > Disk space? > > Bandwidth? > > > > I mean, we already assume you have a lot of each anyway? > > This