vfio, iommufd: Enabling user space drivers to vend more granular access to client pro...
summary
Runs a user space driver on legacy VFIO containers today and plans to move to MMUFD imminently, but currently shares whole VFIO/MMU file descriptors so clients get far more access than needed. Proposes carving BAR regions into dma-buf-backed slices that clients mmap, requires dma-buf MAP/revoke support plus either explicit revoke or pidfd-based observation for lifetime control, and explores attaching BPF policies to MMUFD to make mmap/ioctl decisions; prototypes run in Meta’s ASIC platform stack and the DMA-buf composition is the practical path forward.
AI-written summary · about
chapters (9)
- 0:00Introduction and motivation
- 4:55Current access hygiene issues
- 7:24Goals for access control
- 10:13DMA-BUF for granular access
- 15:14Lifetime management options
- 20:15Kernel vs user space driver trade-offs
- 23:05MMUFD access granularity
- 26:34Recap and future work
- 27:37Q&A and closing
related talks
39miommufd discussion
27mIOMMUFD Integration in QEMU
50mExporting Virtual Memory as dmabuf
49mTransport-level Testing of NVMe Devices using VFIO
55mSecure IO BoF
28mIntroduce Hardware-Level Device Isolation to Zephyr
21mI/O Virtualization Use Cases and the RISC-V IOMMU Overview
46mIOMMU overhead optimizations and observability