1 .. SPDX-License-Identifier: BSD-3-Clause
2 Copyright(c) 2010-2015 Intel Corporation.
3 Copyright 2017 Mellanox Technologies, Ltd
6 .. _linux_gsg_linux_drivers:
11 Different PMDs may require different kernel drivers in order to work properly.
12 Depending on the PMD being used, a corresponding kernel driver should be loaded,
13 and network ports should be bound to that driver.
18 VFIO is a robust and secure driver that relies on IOMMU protection.
19 To make use of VFIO, the ``vfio-pci`` module must be loaded:
21 .. code-block:: console
23 sudo modprobe vfio-pci
25 VFIO kernel is usually present by default in all distributions,
26 however please consult your distributions documentation to make sure that is the case.
28 Since Linux version 5.7,
29 the ``vfio-pci`` module supports the creation of virtual functions.
30 After the PF is bound to ``vfio-pci`` module,
31 the user can create the VFs using the ``sysfs`` interface,
32 and these VFs will be bound to ``vfio-pci`` module automatically.
34 When the PF is bound to ``vfio-pci``,
35 by default it will have a randomly generated VF token.
36 For security reasons, this token is write only,
37 so the user cannot read it from the kernel directly.
38 To access the VFs, the user needs to create a new token,
39 and use it to initialize both VF and PF devices.
40 The tokens are in UUID format,
41 so any UUID generation tool can be used to create a new token.
43 This VF token can be passed to DPDK by using EAL parameter ``--vfio-vf-token``.
44 The token will be used for all PF and VF ports within the application.
46 #. Generate the VF token by uuid command
48 .. code-block:: console
50 14d63f20-8445-11ea-8900-1f9ce7d5650d
52 #. Load the ``vfio-pci`` module with ``enable_sriov`` parameter set
54 .. code-block:: console
56 sudo modprobe vfio-pci enable_sriov=1
58 #. Bind the PCI devices to ``vfio-pci`` driver
60 .. code-block:: console
62 ./usertools/dpdk-devbind.py -b vfio-pci 0000:86:00.0
64 #. Create the desired number of VF devices
66 .. code-block:: console
68 echo 2 > /sys/bus/pci/devices/0000:86:00.0/sriov_numvfs
70 #. Start the DPDK application that will manage the PF device
72 .. code-block:: console
74 <build_dir>/app/dpdk-testpmd -l 22-25 -n 4 -a 86:00.0 \
75 --vfio-vf-token=14d63f20-8445-11ea-8900-1f9ce7d5650d --file-prefix=pf -- -i
77 #. Start the DPDK application that will manage the VF device
79 .. code-block:: console
81 <build_dir>/app/dpdk-testpmd -l 26-29 -n 4 -a 86:02.0 \
82 --vfio-vf-token=14d63f20-8445-11ea-8900-1f9ce7d5650d --file-prefix=vf0 -- -i
84 To make use of full VFIO functionality,
85 both kernel and BIOS must support and be configured
86 to use IO virtualization (such as IntelĀ® VT-d).
90 Linux versions earlier than version 3.6 do not support VFIO.
94 Linux versions earlier than version 5.7 do not support the creation of
95 virtual functions within the VFIO framework.
99 In most cases, specifying "iommu=on" as kernel parameter should be enough to
100 configure the Linux kernel to use IOMMU.
102 For proper operation of VFIO when running DPDK applications as a non-privileged user, correct permissions should also be set up.
103 For more information, please refer to :ref:`Running_Without_Root_Privileges`.
107 VFIO can be used without IOMMU.
108 While this is unsafe, it does make it possible for the user
109 to keep the degree of device access and programming that VFIO has,
110 in situations where IOMMU is not available.
115 In situations where using VFIO is not an option, there are alternative drivers one can use.
116 In many cases, the standard ``uio_pci_generic`` module included in the Linux kernel
117 can be used as a substitute for VFIO. This module can be loaded using the command:
119 .. code-block:: console
121 sudo modprobe uio_pci_generic
125 ``uio_pci_generic`` module doesn't support the creation of virtual functions.
127 As an alternative to the ``uio_pci_generic``, there is the ``igb_uio`` module
128 which can be found in the repository `dpdk-kmods <http://git.dpdk.org/dpdk-kmods>`_.
129 It can be loaded as shown below:
131 .. code-block:: console
134 sudo insmod igb_uio.ko
138 If UEFI secure boot is enabled,
139 the Linux kernel may disallow the use of UIO on the system.
140 Therefore, devices for use by DPDK should be bound to the ``vfio-pci`` kernel module
141 rather than any UIO-based module.
142 For more details see :ref:`linux_gsg_binding_kernel` below.
146 If the devices used for DPDK are bound to the ``uio_pci_generic`` kernel module,
147 please make sure that the IOMMU is disabled or is in passthrough mode.
148 One can add ``intel_iommu=off`` or ``amd_iommu=off`` or ``intel_iommu=on iommu=pt``
149 in GRUB command line on x86_64 systems,
150 or add ``iommu.passthrough=1`` on aarch64 systems.
154 Using UIO drivers is inherently unsafe due to this method lacking IOMMU protection,
155 and can only be done by root user.
157 .. _bifurcated_driver:
162 PMDs which use the bifurcated driver co-exists with the device kernel driver.
163 On such model the NIC is controlled by the kernel, while the data
164 path is performed by the PMD directly on top of the device.
166 Such model has the following benefits:
168 - It is secure and robust, as the memory management and isolation
169 is done by the kernel.
170 - It enables the user to use legacy linux tools such as ``ethtool`` or
171 ``ifconfig`` while running DPDK application on the same network ports.
172 - It enables the DPDK application to filter only part of the traffic,
173 while the rest will be directed and handled by the kernel driver.
174 The flow bifurcation is performed by the NIC hardware.
175 As an example, using :ref:`flow_isolated_mode` allows to choose
176 strictly what is received in DPDK.
178 More about the bifurcated driver can be found in
179 `Mellanox Bifurcated DPDK PMD
180 <https://www.dpdk.org/wp-content/uploads/sites/35/2016/10/Day02-Session04-RonyEfraim-Userspace2016.pdf>`__.
182 .. _linux_gsg_binding_kernel:
184 Binding and Unbinding Network Ports to/from the Kernel Modules
185 --------------------------------------------------------------
189 PMDs which use the bifurcated driver should not be unbound from their kernel drivers.
190 This section is for PMDs which use the UIO or VFIO drivers.
192 As of release 1.4, DPDK applications no longer automatically unbind all supported network ports from the kernel driver in use.
193 Instead, in case the PMD being used use the VFIO or UIO drivers,
194 all ports that are to be used by a DPDK application must be bound to
195 the ``vfio-pci``, ``uio_pci_generic``, or ``igb_uio`` module
196 before the application is run.
197 For such PMDs, any network ports under Linux* control will be ignored and cannot be used by the application.
199 To bind ports to the ``vfio-pci``, ``uio_pci_generic`` or ``igb_uio`` module
200 for DPDK use, or to return ports to Linux control,
201 a utility script called ``dpdk-devbind.py`` is provided in the ``usertools`` subdirectory.
202 This utility can be used to provide a view of the current state of the network ports on the system,
203 and to bind and unbind those ports from the different kernel modules,
204 including the VFIO and UIO modules.
205 The following are some examples of how the script can be used.
206 A full description of the script and its parameters can be obtained
207 by calling the script with the ``--help`` or ``--usage`` options.
208 Note that the UIO or VFIO kernel modules to be used,
209 should be loaded into the kernel before running the ``dpdk-devbind.py`` script.
213 Due to the way VFIO works, there are certain limitations
214 to which devices can be used with VFIO.
215 Mainly it comes down to how IOMMU groups work.
216 Any Virtual Function device can usually be used with VFIO on its own,
217 but physical devices may require either all ports bound to VFIO,
218 or some of them bound to VFIO while others not being bound to anything at all.
220 If your device is behind a PCI-to-PCI bridge,
221 the bridge will then be part of the IOMMU group in which your device is in.
222 Therefore, the bridge driver should also be unbound from the bridge PCI device
223 for VFIO to work with devices behind the bridge.
227 While any user can run the ``dpdk-devbind.py`` script
228 to view the status of the network ports,
229 binding or unbinding network ports requires root privileges.
231 To see the status of all network ports on the system:
233 .. code-block:: console
235 ./usertools/dpdk-devbind.py --status
237 Network devices using DPDK-compatible driver
238 ============================================
239 0000:82:00.0 '82599EB 10-GbE NIC' drv=uio_pci_generic unused=ixgbe
240 0000:82:00.1 '82599EB 10-GbE NIC' drv=uio_pci_generic unused=ixgbe
242 Network devices using kernel driver
243 ===================================
244 0000:04:00.0 'I350 1-GbE NIC' if=em0 drv=igb unused=uio_pci_generic *Active*
245 0000:04:00.1 'I350 1-GbE NIC' if=eth1 drv=igb unused=uio_pci_generic
246 0000:04:00.2 'I350 1-GbE NIC' if=eth2 drv=igb unused=uio_pci_generic
247 0000:04:00.3 'I350 1-GbE NIC' if=eth3 drv=igb unused=uio_pci_generic
249 Other network devices
250 =====================
253 To bind device ``eth1``,``04:00.1``, to the ``uio_pci_generic`` driver:
255 .. code-block:: console
257 ./usertools/dpdk-devbind.py --bind=uio_pci_generic 04:00.1
261 .. code-block:: console
263 ./usertools/dpdk-devbind.py --bind=uio_pci_generic eth1
265 To restore device ``82:00.0`` to its original kernel binding:
267 .. code-block:: console
269 ./usertools/dpdk-devbind.py --bind=ixgbe 82:00.0