I have a system with a ConnectX NIC and a GPU. This is NOT a DPU. For security reasons, I need to be able to get a rootless application to process DOCA Flow-steered UDP packets using DOCA GPUNetIO. However, the documentation clearly states that Flow requires root permissions to use.
I’d LIKE to be able to break the FLOW usage that needs root out into a constrained application that performs the HWS initialization. Then another process without root permissions would ultimately consume the packets from the GPU RXQ. Is this possible with DOCA as it exists today? If not, are there any plans to support this in the future? Or to somehow remove the root permissions requirement with a one-time root action/configuration?
It looks like DPDK might be able to support something similar with multi-process support, but since DOCA uses DPDK under the hood, I’m wondering if this support is already included and I missed the sample code or function calls that would expose this functionality.
Short answer: with DOCA today, any GPUNetIO Ethernet pipeline that uses DOCA Flow for steering must run with root/sudo — Flow/HWS initialization is the part that needs the privilege, and there isn’t a supported “privileged init in one process, rootless consumer in another” split for the Flow side at this time.
The documented rootless path only covers Verbs, RDMA, and DMA, which can run without sudo once the NVIDIA driver is configured with NVreg_RegistryDwords=“PeerMappingOverride=1;”. That does not extend to DOCA Flow / HWS.
See the GPUNetIO “Permissions” / “Running without Root Privileges” section:
For a concrete supported configuration on your specific ConnectX + GPU setup (and to confirm current behavior on your DOCA version), please open an NVIDIA Enterprise Support case so we can look at it properly.
For the “is this on the roadmap / can the root requirement be removed” part, this is a product/feature direction question — your NVIDIA account/sales team is the best channel to capture that as a formal request.