Re: [Qemu-devel] [PATCH v4 1/3] memory: introduce IOMMUNotifier and its caps

[David Gibson]

On Wed, Sep 14, 2016 at 03:40:08PM +0800, Peter Xu wrote:
> On Wed, Sep 14, 2016 at 05:15:03PM +1000, David Gibson wrote:
> 
> [...]
> 
> > > > @@ -1564,8 +1569,22 @@ void 
> > > > memory_region_unregister_iommu_notifier(MemoryRegion *mr, Notifier *n)
> > > >  void memory_region_notify_iommu(MemoryRegion *mr,
> > > >                                  IOMMUTLBEntry entry)
> > > >  {
> > > > +    IOMMUNotifier *iommu_notifier;
> > > > +    IOMMUNotifierFlag request_flags;
> > > > +
> > > >      assert(memory_region_is_iommu(mr));
> > > > -    notifier_list_notify(&mr->iommu_notify, &entry);
> > > > +
> > > > +    if (entry.perm & IOMMU_RW) {
> > > > +        request_flags = IOMMU_NOTIFIER_MAP;
> > > > +    } else {
> > > > +        request_flags = IOMMU_NOTIFIER_UNMAP;
> > > > +    }
> > > 
> > > This is still wrong.  UNMAP depends on the *previous* state of the
> > > mapping, not the new state.
> > 
> > Peter pointed out to be on IRC that VFIO already assumes that it's
> > only an unmap if the new permissions are NONE.  So one can argue that
> > it's an existing constraint of the IOMMUTLBEntry interface that a
> > mapping can only ever transition from valid->invalid or
> > invalid->valid.  Changing one valid entry to another would require two
> > notifications one switching it to a blank entry with NONE permissions,
> > then another notifying the new valid mapping.
> > 
> > Assuming that constraint, Peter's patch is correct.
> > 
> > I'm pretty uneasy about that constraint, because it's not necessarily
> > obvious to someone implementing a new vIOMMU device, which is
> > responsible for triggering the notifies.  From just the callback, it
> > looks like it should be fine to just fire the notify with the new
> > mapping which replaced the old.
> > 
> > Peter suggested commenting this next to the IOTLBEntry definition, and
> > I think that's probably ok for now.  I do think we should consider
> > changing the notify interface to make this more obvious.  I can see
> > one of two ways to do that:
> > 
> >     * Fully allow in-place changes to be notified - the callback would
> >       need to be passed both the new entry and at least the old
> >       permissions, if not the old entry.
> > 
> >     * Instead have separate map and unmap notifier chains with
> >       separate callbacks.  That should make it obvious to a vIOMMU
> >       author that an in-place change would need first an unmap
> >       notify, then a map notify.
> 
> Thanks for the summary!
> 
> Since we are at this... I am still curious about when we will need
> this CHANGE interface.

It doesn't require any new interface, just removal of a subtle
constraint on the current one.

And we don't, strictly speaking, need it.  However, leaving subtle
constraints in how you can use an interface that aren't obvious from
the interface itself, and can't be verified by the interface is just
leaving booby traps for future developers.

> Not to talk about Linux kernel, yes we can have other guest OS
> running. However for any guests, IMHO changing IOMMU PTE is extremely
> dangerous. For example, if we have mapped an area of memory, e.g.
> three DMA pages, each 4K (which really doesn't matter):
> 
>     page1 (0-4k)
>     page2 (4k-8k)
>     page3 (8k-12k)
> 
> If we want to modify the 12K mapping (e.g., change in-place from page1
> to page3 in order), the result can be undefined. Since IOMMU might
> still be using these page mappings during the modification. The
> problem is that, we cannot do this change for the three pages in an
> atomic operation. So if IOMMU uses these pages during the modification
> (e.g., CPU just changed page1, but not yet for page2 and page3), IOMMU
> will see an inconsistent view of memory. That's trouble.

Yes, changing the IOMMU mappings will require synchronization with
device drivers and hardware, but what that involves is between the
guest and the vIOMMU implementation.  Having "simultaneous" unmap/map
is a somewhat unlikely in pratice, I'll grant, but it's absolutely
possible that a vIOMMU could do this safely.

I could even imagine it happening if the guest always maps and unmaps
separately, if the vIOMMU did some sort of operation batching.

> I guess this is why Linux is using unmap_page() and map_page() for it?
> Or say, we just do not allow to change the content of it directly. Not
> sure.

I'm not sure what you mean by that.  Sounds kind of like my option 2
above - only allow separate maps and unmaps, but change the notify
interface to make that more obvious to the vIOMMU implementor.

> Also, I assume we may need something like "quiesce" IOMMU
> operation (or not operation, but existing procedures?) to finally make
> sure that the pages we are removing will never be touched by IOMMU any
> more before freeing them.

Yes.. I'm not sure if you're thinking of the guest side or host side
here.

> All above is wild guess of me, just want to know when and why we will
> need this CHANGE stuff.
> 
> And before we finally realize we need this, I would still suggest to
> keep the old interface (as long as it can work for us, no extra effort
> needed), and as David has mentioned, we can add comment for
> IOMMUTLBEntry to make sure people can know its meaning easier (before
> starting to read vfio_iommu_map_notify() codes).
> 
> Thanks,
> 
> -- peterx
> 

-- 
David Gibson                    | I'll have my music baroque, and my code
david AT gibson.dropbear.id.au  | minimalist, thank you.  NOT _the_ _other_
                                | _way_ _around_!
http://www.ozlabs.org/~dgibson

signature.asc
Description: PGP signature