linux-kernel - Re: [RFC PATCH 3/7] vfio: add spimdev support

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 6 Aug 2018 11:05:21 -0600
From:   Alex Williamson <alex.williamson@...hat.com>
To:     "Raj, Ashok" <ashok.raj@...el.com>
Cc:     Kenneth Lee <liguozhu@...ilicon.com>,
        "kvm@...r.kernel.org" <kvm@...r.kernel.org>,
        "linux-doc@...r.kernel.org" <linux-doc@...r.kernel.org>,
        Zaibo Xu <xuzaibo@...wei.com>, sanjay.k.kumar@...el.com,
        Kenneth Lee <nek.in.cn@...il.com>,
        Hao Fang <fanghao11@...wei.com>,
        Herbert Xu <herbert@...dor.apana.org.au>,
        Jonathan Corbet <corbet@....net>,
        Joerg Roedel <joro@...tes.org>,
        Zhou Wang <wangzhou1@...ilicon.com>,
        "Tian, Kevin" <kevin.tian@...el.com>, linuxarm@...wei.com,
        Thomas Gleixner <tglx@...utronix.de>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Cornelia Huck <cohuck@...hat.com>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "iommu@...ts.linux-foundation.org" <iommu@...ts.linux-foundation.org>,
        "linux-crypto@...r.kernel.org" <linux-crypto@...r.kernel.org>,
        Philippe Ombredanne <pombredanne@...b.com>,
        "David S . Miller" <davem@...emloft.net>,
        "linux-accelerators@...ts.ozlabs.org" 
        <linux-accelerators@...ts.ozlabs.org>,
        Lu Baolu <baolu.lu@...ux.intel.com>
Subject: Re: [RFC PATCH 3/7] vfio: add spimdev support

On Mon, 6 Aug 2018 09:34:28 -0700
"Raj, Ashok" <ashok.raj@...el.com> wrote:

> On Mon, Aug 06, 2018 at 09:49:40AM -0600, Alex Williamson wrote:
> > On Mon, 6 Aug 2018 09:40:04 +0800
> > Kenneth Lee <liguozhu@...ilicon.com> wrote:  
> > > 
> > > 1. It supports thousands of processes. Take zip accelerator as an example, any
> > > application need data compression/decompression will need to interact with the
> > > accelerator. To support that, you have to create tens of thousands of mdev for
> > > their usage. I don't think it is a good idea to have so many devices in the
> > > system.  
> > 
> > Each mdev is a device, regardless of whether there are hardware
> > resources committed to the device, so I don't understand this argument.
> >    
> > > 2. The application does not want to own the mdev for long. It just need an
> > > access point for the hardware service. If it has to interact with an management
> > > agent for allocation and release, this makes the problem complex.  
> > 
> > I don't see how the length of the usage plays a role here either.  Are
> > you concerned that the time it takes to create and remove an mdev is
> > significant compared to the usage time?  Userspace is certainly welcome
> > to create a pool of devices, but why should it be the kernel's
> > responsibility to dynamically assign resources to an mdev?  What's the
> > usage model when resources are unavailable?  It seems there's
> > complexity in either case, but it's generally userspace's responsibility
> > to impose a policy.
> >   
> 
> Can vfio dev's created representing an mdev be shared between several 
> processes?  It doesn't need to be exclusive.
> 
> The path to hardware is established by the processes binding to SVM and
> IOMMU ensuring that the PASID is plummed properly.  One can think the 
> same hardware is shared between several processes, hardware knows the 
> isolation is via the PASID. 
> 
> For these cases it isn't required to create a dev per process. 

The iommu group is the unit of ownership, a vfio group mirrors an iommu
group, therefore a vfio group only allows a single open(2).  A group
also represents the minimum isolation set of devices, therefore devices
within a group are not considered isolated and must share the same
address space represented by the vfio container.  Beyond that, it is
possible to share devices among processes, but (I think) it generally
implies a hierarchical rather than peer relationship between
processes.  Thanks,

Alex