From: "Tian, Kevin" <kevin.tian@intel.com>
To: "Liu, Yi L" <yi.l.liu@intel.com>,
"alex.williamson@redhat.com" <alex.williamson@redhat.com>,
"jgg@nvidia.com" <jgg@nvidia.com>
Cc: "cohuck@redhat.com" <cohuck@redhat.com>,
"eric.auger@redhat.com" <eric.auger@redhat.com>,
"nicolinc@nvidia.com" <nicolinc@nvidia.com>,
"kvm@vger.kernel.org" <kvm@vger.kernel.org>,
"mjrosato@linux.ibm.com" <mjrosato@linux.ibm.com>,
"chao.p.peng@linux.intel.com" <chao.p.peng@linux.intel.com>,
"yi.y.sun@linux.intel.com" <yi.y.sun@linux.intel.com>,
"peterx@redhat.com" <peterx@redhat.com>,
"jasowang@redhat.com" <jasowang@redhat.com>,
"shameerali.kolothum.thodi@huawei.com"
<shameerali.kolothum.thodi@huawei.com>,
"lulu@redhat.com" <lulu@redhat.com>,
"suravee.suthikulpanit@amd.com" <suravee.suthikulpanit@amd.com>,
"intel-gvt-dev@lists.freedesktop.org"
<intel-gvt-dev@lists.freedesktop.org>,
"intel-gfx@lists.freedesktop.org"
<intel-gfx@lists.freedesktop.org>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
"linux-s390@vger.kernel.org" <linux-s390@vger.kernel.org>
Subject: RE: [PATCH v2 07/14] vfio: Block device access via device fd until device is opened
Date: Tue, 7 Feb 2023 03:52:27 +0000 [thread overview]
Message-ID: <BN9PR11MB5276373EFEBE732B431D87408CDB9@BN9PR11MB5276.namprd11.prod.outlook.com> (raw)
In-Reply-To: <20230206090532.95598-8-yi.l.liu@intel.com>
> From: Liu, Yi L <yi.l.liu@intel.com>
> Sent: Monday, February 6, 2023 5:05 PM
>
> Allow the vfio_device file to be in a state where the device FD is
> opened but the device cannot be used by userspace (i.e. its .open_device()
> hasn't been called). This inbetween state is not used when the device
> FD is spawned from the group FD, however when we create the device FD
> directly by opening a cdev it will be opened in the blocked state.
>
> The reason for the inbetween state is userspace only gets a FD but
...is "that" userspace...
> doesn't have the secure until binding the FD to an iommufd. So in the
"doesn't gain access permission until..."
> blocked state, only the bind operation is allowed, other device accesses
remove the last part which duplicates with "only ... is allowed"
> are not allowed. Completing bind will allow user to further access the
> device.
>
> This is implemented by adding a flag in struct vfio_device_file to mark
> the blocked state and using a simple smp_load_acquire() to obtain the
> flag value and serialize all the device setup with the thread accessing
> this device.
>
> Following this lockless scheme, it can safely handle the device FD
> unbound->bound but it cannot handle bound->unbound. To allow this we'd
> need to add a lock on all the vfio ioctls which seems costly. So once
> device FD is bound, it remains bound until the FD is closed.
>
> Suggested-by: Jason Gunthorpe <jgg@nvidia.com>
> Signed-off-by: Yi Liu <yi.l.liu@intel.com>
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
WARNING: multiple messages have this Message-ID (diff)
From: "Tian, Kevin" <kevin.tian@intel.com>
To: "Liu, Yi L" <yi.l.liu@intel.com>,
"alex.williamson@redhat.com" <alex.williamson@redhat.com>,
"jgg@nvidia.com" <jgg@nvidia.com>
Cc: "linux-s390@vger.kernel.org" <linux-s390@vger.kernel.org>,
"yi.y.sun@linux.intel.com" <yi.y.sun@linux.intel.com>,
"kvm@vger.kernel.org" <kvm@vger.kernel.org>,
"mjrosato@linux.ibm.com" <mjrosato@linux.ibm.com>,
"jasowang@redhat.com" <jasowang@redhat.com>,
"cohuck@redhat.com" <cohuck@redhat.com>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
"peterx@redhat.com" <peterx@redhat.com>,
"eric.auger@redhat.com" <eric.auger@redhat.com>,
"nicolinc@nvidia.com" <nicolinc@nvidia.com>,
"shameerali.kolothum.thodi@huawei.com"
<shameerali.kolothum.thodi@huawei.com>,
"suravee.suthikulpanit@amd.com" <suravee.suthikulpanit@amd.com>,
"chao.p.peng@linux.intel.com" <chao.p.peng@linux.intel.com>,
"lulu@redhat.com" <lulu@redhat.com>,
"intel-gvt-dev@lists.freedesktop.org"
<intel-gvt-dev@lists.freedesktop.org>,
"intel-gfx@lists.freedesktop.org"
<intel-gfx@lists.freedesktop.org>
Subject: Re: [Intel-gfx] [PATCH v2 07/14] vfio: Block device access via device fd until device is opened
Date: Tue, 7 Feb 2023 03:52:27 +0000 [thread overview]
Message-ID: <BN9PR11MB5276373EFEBE732B431D87408CDB9@BN9PR11MB5276.namprd11.prod.outlook.com> (raw)
In-Reply-To: <20230206090532.95598-8-yi.l.liu@intel.com>
> From: Liu, Yi L <yi.l.liu@intel.com>
> Sent: Monday, February 6, 2023 5:05 PM
>
> Allow the vfio_device file to be in a state where the device FD is
> opened but the device cannot be used by userspace (i.e. its .open_device()
> hasn't been called). This inbetween state is not used when the device
> FD is spawned from the group FD, however when we create the device FD
> directly by opening a cdev it will be opened in the blocked state.
>
> The reason for the inbetween state is userspace only gets a FD but
...is "that" userspace...
> doesn't have the secure until binding the FD to an iommufd. So in the
"doesn't gain access permission until..."
> blocked state, only the bind operation is allowed, other device accesses
remove the last part which duplicates with "only ... is allowed"
> are not allowed. Completing bind will allow user to further access the
> device.
>
> This is implemented by adding a flag in struct vfio_device_file to mark
> the blocked state and using a simple smp_load_acquire() to obtain the
> flag value and serialize all the device setup with the thread accessing
> this device.
>
> Following this lockless scheme, it can safely handle the device FD
> unbound->bound but it cannot handle bound->unbound. To allow this we'd
> need to add a lock on all the vfio ioctls which seems costly. So once
> device FD is bound, it remains bound until the FD is closed.
>
> Suggested-by: Jason Gunthorpe <jgg@nvidia.com>
> Signed-off-by: Yi Liu <yi.l.liu@intel.com>
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
next prev parent reply other threads:[~2023-02-07 3:52 UTC|newest]
Thread overview: 63+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-02-06 9:05 [PATCH v2 00/14] Add vfio_device cdev for iommufd support Yi Liu
2023-02-06 9:05 ` [Intel-gfx] " Yi Liu
2023-02-06 9:05 ` [Intel-gfx] [PATCH v2 01/14] vfio: Allocate per device file structure Yi Liu
2023-02-06 9:05 ` Yi Liu
2023-02-06 9:05 ` [Intel-gfx] [PATCH v2 02/14] vfio: Refine vfio file kAPIs Yi Liu
2023-02-06 9:05 ` Yi Liu
2023-02-06 9:05 ` [PATCH v2 03/14] vfio: Accept vfio device file in the driver facing kAPI Yi Liu
2023-02-06 9:05 ` [Intel-gfx] " Yi Liu
2023-02-07 3:25 ` Tian, Kevin
2023-02-07 3:25 ` [Intel-gfx] " Tian, Kevin
2023-02-06 9:05 ` [PATCH v2 04/14] kvm/vfio: Rename kvm_vfio_group to prepare for accepting vfio device fd Yi Liu
2023-02-06 9:05 ` [Intel-gfx] " Yi Liu
2023-02-06 9:05 ` [PATCH v2 05/14] kvm/vfio: Accept vfio device file from userspace Yi Liu
2023-02-06 9:05 ` [Intel-gfx] " Yi Liu
2023-02-07 3:36 ` Tian, Kevin
2023-02-07 3:36 ` [Intel-gfx] " Tian, Kevin
2023-02-07 8:39 ` Liu, Yi L
2023-02-07 8:39 ` [Intel-gfx] " Liu, Yi L
2023-02-06 9:05 ` [PATCH v2 06/14] vfio: Pass struct vfio_device_file * to vfio_device_open/close() Yi Liu
2023-02-06 9:05 ` [Intel-gfx] " Yi Liu
2023-02-07 3:42 ` Tian, Kevin
2023-02-07 3:42 ` [Intel-gfx] " Tian, Kevin
2023-02-06 9:05 ` [PATCH v2 07/14] vfio: Block device access via device fd until device is opened Yi Liu
2023-02-06 9:05 ` [Intel-gfx] " Yi Liu
2023-02-07 3:52 ` Tian, Kevin [this message]
2023-02-07 3:52 ` Tian, Kevin
2023-02-06 9:05 ` [Intel-gfx] [PATCH v2 08/14] vfio: Add infrastructure for bind_iommufd from userspace Yi Liu
2023-02-06 9:05 ` Yi Liu
2023-02-07 3:56 ` [Intel-gfx] " Tian, Kevin
2023-02-07 3:56 ` Tian, Kevin
2023-02-06 9:05 ` [Intel-gfx] [PATCH v2 09/14] vfio-iommufd: Add detach_ioas support for physical VFIO devices Yi Liu
2023-02-06 9:05 ` Yi Liu
2023-02-07 6:06 ` Tian, Kevin
2023-02-07 6:06 ` [Intel-gfx] " Tian, Kevin
2023-02-07 8:56 ` Liu, Yi L
2023-02-07 8:56 ` [Intel-gfx] " Liu, Yi L
2023-02-06 9:05 ` [Intel-gfx] [PATCH v2 10/14] vfio-iommufd: Add detach_ioas for emulated " Yi Liu
2023-02-06 9:05 ` Yi Liu
2023-02-07 6:08 ` Tian, Kevin
2023-02-07 6:08 ` [Intel-gfx] " Tian, Kevin
2023-02-06 9:05 ` [Intel-gfx] [PATCH v2 11/14] vfio: Make vfio_device_open() exclusive between group path and device cdev path Yi Liu
2023-02-06 9:05 ` Yi Liu
2023-02-07 6:24 ` Tian, Kevin
2023-02-07 6:24 ` [Intel-gfx] " Tian, Kevin
2023-02-07 8:54 ` Liu, Yi L
2023-02-07 8:54 ` [Intel-gfx] " Liu, Yi L
2023-02-06 9:05 ` [Intel-gfx] [PATCH v2 12/14] vfio: Add cdev for vfio_device Yi Liu
2023-02-06 9:05 ` Yi Liu
2023-02-07 7:54 ` Tian, Kevin
2023-02-07 7:54 ` [Intel-gfx] " Tian, Kevin
2023-02-10 11:31 ` Joao Martins
2023-02-10 11:31 ` [Intel-gfx] " Joao Martins
2023-02-06 9:05 ` [Intel-gfx] [PATCH v2 13/14] vfio: Add ioctls for device cdev using iommufd Yi Liu
2023-02-06 9:05 ` Yi Liu
2023-02-07 3:41 ` Yan Zhao
2023-02-07 3:41 ` [Intel-gfx] " Yan Zhao
2023-02-07 7:50 ` Liu, Yi L
2023-02-07 7:50 ` Liu, Yi L
2023-02-07 9:17 ` Tian, Kevin
2023-02-07 9:17 ` [Intel-gfx] " Tian, Kevin
2023-02-06 9:05 ` [Intel-gfx] [PATCH v2 14/14] vfio: Compile group optionally Yi Liu
2023-02-06 9:05 ` Yi Liu
2023-02-06 11:55 ` [Intel-gfx] ✗ Fi.CI.BUILD: failure for Add vfio_device cdev for iommufd support Patchwork
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=BN9PR11MB5276373EFEBE732B431D87408CDB9@BN9PR11MB5276.namprd11.prod.outlook.com \
--to=kevin.tian@intel.com \
--cc=alex.williamson@redhat.com \
--cc=chao.p.peng@linux.intel.com \
--cc=cohuck@redhat.com \
--cc=eric.auger@redhat.com \
--cc=intel-gfx@lists.freedesktop.org \
--cc=intel-gvt-dev@lists.freedesktop.org \
--cc=jasowang@redhat.com \
--cc=jgg@nvidia.com \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-s390@vger.kernel.org \
--cc=lulu@redhat.com \
--cc=mjrosato@linux.ibm.com \
--cc=nicolinc@nvidia.com \
--cc=peterx@redhat.com \
--cc=shameerali.kolothum.thodi@huawei.com \
--cc=suravee.suthikulpanit@amd.com \
--cc=yi.l.liu@intel.com \
--cc=yi.y.sun@linux.intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.