4

I would like to ask you, what is advantage of using VFIO-PCI over PCI-STUB?

I found this article "PCI passthrough via OVMF" , but they do not say all advantages, they just say that VFIO has some benefits.

Thank you

3

PCI-STUB is a dummy driver. It was originally developed because the original KVM device assignment didn't actually bind to the assigned device as a host driver, it simply grabbed the device and started using it. As KVM isn't a proper device driver, another host driver could attempt to bind to the device while KVM had it assigned to a user. The pci-stub driver was introduced to occupy the driver slot for the device while KVM made use of it.

As opposed to pci-stub, vfio is a complete interface for userspace drivers. It provides secure, isolated and IOMMU protected access to the device.

Advantages of vfio:

  1. pci-stub is often built into the kernel, this allows it to bind to devices earlier than drivers that are loadable modules. With this setup we can instruct pci-stub to bind to devices before the host driver can get to them so we can keep the device in a pristine state for assignment to a guest.

  2. The other lesser use case with vfio is with IOMMU grouping. If you have a group with multiple devices all the devices in the group must be bound to compatible drivers or else vfio will consider the group non-viable. This is intended to prevent host drivers within the same group as a user controlled device as they would not be isolated from each other. With pci-stub, we know this driver does not initiate any DMA on behalf of the host, so we consider it compatible.

    Thus if you have endpoints in your IOMMU group that you need to do something with to make the group viable, but you want to make sure the user doesn't have access to it, you can bind the device to pci-stub. This adds a little bit of extra protection vs binding the device to vfio-pci as a compromised user could not simply open other devices within the group that are bound to vfio-pci through the vfio interface.

  • Thank you and is possible to block / unblock PCI during runtime using VFIO-PCI? – tomsk Jun 24 '18 at 20:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.