Re: [PATCH V4 05/18] iommu/ioasid: Redefine IOASID set and allocation APIs

On Thu, Apr 01, 2021 at 02:05:00PM +0200, Jean-Philippe Brucker wrote:

On Thu, Apr 01, 2021 at 07:04:01AM +0000, Liu, Yi L wrote:

quoted

quoted

- how about AMD and ARM's vSVA support? Their PASID allocation and page
table
  happens within guest. They only need to bind the guest PASID table to
host.

In this case each VM has its own IOASID space, and the host IOASID
allocator doesn't participate. Plus this only makes sense when assigning a
whole VF to a guest, and VFIO is the tool for this. So I wouldn't shoehorn
those ops into /dev/ioasid, though we do need a transport for invalidate
commands.

How does security work? Devices still have to be authorized to use the
PASID and this approach seems like it completely excludes mdev/vdpa
from ever using a PASID, and those are the most logical users.

quoted

quoted

  Above model seems unable to fit them. (Jean, Eric, Jacob please feel free
  to correct me)
- this per-ioasid SVA operations is not aligned with the native SVA usage
  model. Native SVA bind is per-device.

Bare-metal SVA doesn't need /dev/ioasid either. 

It depends what you are doing. /dev/ioasid would provide fine grained
control over the memory mapping. It is not strict SVA, but I can see
applications where using a GPU with a pre-configured optimized mapping
could be interesting.

A program uses a device handle to either ask whether SVA is enabled,
or to enable it explicitly.  With or without /dev/ioasid, that step
is required. OpenCL uses the first method - automatically enable
"fine-grain system SVM" if available, and provide a flag to
userspace.

SVA can be done with ioasid, we can decide if it makes sense to have
shortcuts in every driver

So userspace does not need to know about PASID. It's only one method for
doing SVA (some GPUs are context-switching page tables instead).

Sure, there are lots of approaches. Here we are only talking about
PASID enablement. PASID has more options.
 

* Page faults, page response. From and to devices, and don't necessarily
  have a PASID. But needed by vdpa as well, so that's also going through
  /dev/ioasid?

Only real PASID's should use this interface. All the not-PASID stuff
is on its own.

VPDA should accept a PASID from here and configure&authorize the real
HW to attach the PASID to all DMA's connected to the virtio queues.

Jason