2017-12-05 14:07:13

by Cornelia Huck

[permalink] [raw]
Subject: Re: [RFC 00/19] KVM: s390/crypto/vfio: guest dedicated crypto adapters

On Mon, 27 Nov 2017 19:39:32 -0500
Tony Krowiak <[email protected]> wrote:

> On 11/22/2017 08:47 AM, Cornelia Huck wrote:
> > On Tue, 21 Nov 2017 11:08:01 -0500
> > Tony Krowiak <[email protected]> wrote:
> >
> >
> >> I am not quite sure what you are asking, but I'll attempt to answer
> >> what I think you're asking. A new type of mediated matrix device
> >> will be introduced to configure a virtual matrix for a guest that
> >> provides the interfaces to map a virtual adapter/domain ID to one
> >> or more real adapter/domain IDs. If by virtualization facility,
> >> you are talking about the VFIO AP matrix driver, then yes,
> >> the driver will handle ioctl requests based on the type of the
> >> mediated matrix device through which the request was submitted:
> >>
> >> If the request is to configure the KVM guest's matrix:
> >>
> >> * If the mediated matrix device type is passthrough:
> >> * Do validation of matrix
> >> * Configure the APM, AQM and ADM in the KVM guest's CRYCB
> >> according to the configuration specified via the mediated
> >> device's sysfs attribute files.
> >> * If the mediated matrix device type is virtual:
> >> * Do validation of matrix
> >> * No need to configure CRYCB since all instructions will be
> >> intercepted
> > Ok, so we would have two distinct paths here...
> It depends upon what you mean by two distinct paths. Configuring the
> mediated device would require a new mediated device type for virtualized
> AP matrices. The ioctl for configuring the KVM guest's CRYCB would
> require an additional check to determine whether the CRYCB need be
> configured or not.

Yes, the new type makes this distinct enough so that we can think about
this later.

> >
> >> If the request is to execute an intercepted AP instruction:
> >>
> >> * If the mediated matrix device type is passthrough:
> >> * Forward the instruction to the AP device and return the
> >> result to QEMU.
> >>
> >> * If the mediated matrix device type is virtual:
> >>
> >> * Retrieve all of the real APQNs mapped to the virtual
> >> adapter and domain IDs configured in the mediated matrix
> >> device's sysfs attribute files
> >> * If there is more than one APQN mapping, then determine
> >> which would be best to use - algorithm TBD
> >> * Forward the instruction to the AP device and return the
> >> result.
> > ...and two distinct paths for most instructions here as well.
> The driver would require additional ioctls to handle
> interception of all AP instructions for virtual matrices and additional
> code to remap virtual APQNs to real APQNs and determine which real APQN
> to which intercepted instructions should be forwarded.
> >
> >> Of course, these are just preliminary ideas at this time.
> >> I've only prototyped the sysfs configuration interfaces. No
> >> back end prototyping has been undertaken yet. If the ideas do
> >> not pan out, however; I think virtualization can be introduced
> >> as an independent design.
> > Yes, let's cross that bridge when we get to it.
> That is the plan. Given Pierre's objections, I thought it might help
> to touch on this.

OK, so I admit that I lost track a bit. Are there any remaining issues
beyond the feature handling? Would it make sense to post a v2?


2017-12-05 15:09:44

by Tony Krowiak

[permalink] [raw]
Subject: Re: [RFC 00/19] KVM: s390/crypto/vfio: guest dedicated crypto adapters

On 12/05/2017 09:06 AM, Cornelia Huck wrote:
> On Mon, 27 Nov 2017 19:39:32 -0500
> Tony Krowiak <[email protected]> wrote:
>
>> On 11/22/2017 08:47 AM, Cornelia Huck wrote:
>>> On Tue, 21 Nov 2017 11:08:01 -0500
>>> Tony Krowiak <[email protected]> wrote:
>>>
>>>
>>>> I am not quite sure what you are asking, but I'll attempt to answer
>>>> what I think you're asking. A new type of mediated matrix device
>>>> will be introduced to configure a virtual matrix for a guest that
>>>> provides the interfaces to map a virtual adapter/domain ID to one
>>>> or more real adapter/domain IDs. If by virtualization facility,
>>>> you are talking about the VFIO AP matrix driver, then yes,
>>>> the driver will handle ioctl requests based on the type of the
>>>> mediated matrix device through which the request was submitted:
>>>>
>>>> If the request is to configure the KVM guest's matrix:
>>>>
>>>> * If the mediated matrix device type is passthrough:
>>>> * Do validation of matrix
>>>> * Configure the APM, AQM and ADM in the KVM guest's CRYCB
>>>> according to the configuration specified via the mediated
>>>> device's sysfs attribute files.
>>>> * If the mediated matrix device type is virtual:
>>>> * Do validation of matrix
>>>> * No need to configure CRYCB since all instructions will be
>>>> intercepted
>>> Ok, so we would have two distinct paths here...
>> It depends upon what you mean by two distinct paths. Configuring the
>> mediated device would require a new mediated device type for virtualized
>> AP matrices. The ioctl for configuring the KVM guest's CRYCB would
>> require an additional check to determine whether the CRYCB need be
>> configured or not.
> Yes, the new type makes this distinct enough so that we can think about
> this later.
>
>>>
>>>> If the request is to execute an intercepted AP instruction:
>>>>
>>>> * If the mediated matrix device type is passthrough:
>>>> * Forward the instruction to the AP device and return the
>>>> result to QEMU.
>>>>
>>>> * If the mediated matrix device type is virtual:
>>>>
>>>> * Retrieve all of the real APQNs mapped to the virtual
>>>> adapter and domain IDs configured in the mediated matrix
>>>> device's sysfs attribute files
>>>> * If there is more than one APQN mapping, then determine
>>>> which would be best to use - algorithm TBD
>>>> * Forward the instruction to the AP device and return the
>>>> result.
>>> ...and two distinct paths for most instructions here as well.
>> The driver would require additional ioctls to handle
>> interception of all AP instructions for virtual matrices and additional
>> code to remap virtual APQNs to real APQNs and determine which real APQN
>> to which intercepted instructions should be forwarded.
>>>
>>>> Of course, these are just preliminary ideas at this time.
>>>> I've only prototyped the sysfs configuration interfaces. No
>>>> back end prototyping has been undertaken yet. If the ideas do
>>>> not pan out, however; I think virtualization can be introduced
>>>> as an independent design.
>>> Yes, let's cross that bridge when we get to it.
>> That is the plan. Given Pierre's objections, I thought it might help
>> to touch on this.
> OK, so I admit that I lost track a bit. Are there any remaining issues
> beyond the feature handling? Would it make sense to post a v2?
I was planning on posting a V2 once the features issue is settled.
>