On Wed, 11 Mar 2020 15:59:12 -0600 Alex Williamson <alex.williamson@xxxxxxxxxx> wrote: > With the VF Token interface we can now expect that a vfio userspace > driver must be in collaboration with the PF driver, an unwitting > userspace driver will not be able to get past the GET_DEVICE_FD step > in accessing the device. We can now move on to actually allowing > SR-IOV to be enabled by vfio-pci on the PF. Support for this is not > enabled by default in this commit, but it does provide a module option > for this to be enabled (enable_sriov=1). Enabling VFs is rather > straightforward, except we don't want to risk that a VF might get > autoprobed and bound to other drivers, so a bus notifier is used to > "capture" VFs to vfio-pci using the driver_override support. We > assume any later action to bind the device to other drivers is > condoned by the system admin and allow it with a log warning. > > vfio-pci will disable SR-IOV on a PF before releasing the device, > allowing a VF driver to be assured other drivers cannot take over the > PF and that any other userspace driver must know the shared VF token. > This support also does not provide a mechanism for the PF userspace > driver itself to manipulate SR-IOV through the vfio API. With this > patch SR-IOV can only be enabled via the host sysfs interface and the > PF driver user cannot create or remove VFs. > > Signed-off-by: Alex Williamson <alex.williamson@xxxxxxxxxx> > --- > drivers/vfio/pci/vfio_pci.c | 106 +++++++++++++++++++++++++++++++---- > drivers/vfio/pci/vfio_pci_private.h | 2 + > 2 files changed, 97 insertions(+), 11 deletions(-) > Reviewed-by: Cornelia Huck <cohuck@xxxxxxxxxx>
