Received: by 10.192.165.148 with SMTP id m20csp381592imm; Fri, 20 Apr 2018 00:20:52 -0700 (PDT) X-Google-Smtp-Source: AIpwx48Ow12JrCr0LpCK33aFiDncMrozXSY2Uw1lYGG49oNtGjHGtqAqb7p503nxzy/TMwQoAJkI X-Received: by 10.99.136.73 with SMTP id l70mr7800531pgd.49.1524208852434; Fri, 20 Apr 2018 00:20:52 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1524208852; cv=none; d=google.com; s=arc-20160816; b=vH//1wo2ISR0RYLZo0xO4e4ne5BhwZg3VEPgpdC5kuCvzLwkbp5We2u5Qlbx1mK1e5 qFmRduVBHP0G/Ut3A2wcZFg5ku+jSeaXDxE17/jEJGNJ0+ojkkXA7Za8VVYZ4gTYHAMK R+SCkrfisVCTKJ3PCB2AUYeHEMYIxH1ERaUHqHVXnPMCr4vi2hAToUflwOXR57jyIMOB f9CXC0uqPbACvtljdUYlGpnJNYojEjB1cocb4xxwg4W3+aHNSex8vW7cmW6zOUXmFicz 55KgZwxms+/F2lp96mOgBZTeZQS1l9b2FHDtZRx/ItdzR784JPWCKdZx4/Db8eKwNE9b cE4g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:user-agent:in-reply-to :content-transfer-encoding:content-disposition:mime-version :references:mail-followup-to:message-id:subject:cc:to:from:date :dkim-signature:arc-authentication-results; bh=PuKQ8hH6y557F/cTz1BUH8YZIfFjDAInl9RUr2d/iIg=; b=n4oc4rTLPiZcXzOonECewJjl64EaEAKgay8jydc0vfrVDCjt4uVKcXC5pwPwKEfaoc kFrhGkRPhCElobtRKopgzrEw0DIzM39n572CRqQY3gibsdhrqffVPMTBLVw9DdDQQNa/ jjUtTlE1t4FeqfpxtpwBWrDzAIJfy8xEJ+GEIRgUY3F9b6mZ2ZWZfQy+TUGablJImgwB ms/Ms+0FiG5S2MfRauexRH9sFAr/+G/eDlt+DmGq9LzS/4M6cT+HdC9ttO/wv9CszEcV rt46MvM8HF8SJEz/+ROYdIGhjq4aQo1q8PjIS5nxSATtWZkUEJriVw5zrf2lzMeD29sl AgEA== ARC-Authentication-Results: i=1; mx.google.com; dkim=fail header.i=@ffwll.ch header.s=google header.b=JnWzzs2E; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id bj11-v6si5100658plb.480.2018.04.20.00.20.38; Fri, 20 Apr 2018 00:20:52 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=fail header.i=@ffwll.ch header.s=google header.b=JnWzzs2E; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753984AbeDTHTV (ORCPT + 99 others); Fri, 20 Apr 2018 03:19:21 -0400 Received: from mail-wr0-f170.google.com ([209.85.128.170]:37817 "EHLO mail-wr0-f170.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753595AbeDTHTT (ORCPT ); Fri, 20 Apr 2018 03:19:19 -0400 Received: by mail-wr0-f170.google.com with SMTP id f14-v6so20151138wre.4 for ; Fri, 20 Apr 2018 00:19:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ffwll.ch; s=google; h=sender:date:from:to:cc:subject:message-id:mail-followup-to :references:mime-version:content-disposition :content-transfer-encoding:in-reply-to:user-agent; bh=PuKQ8hH6y557F/cTz1BUH8YZIfFjDAInl9RUr2d/iIg=; b=JnWzzs2EtOrVqIbAESWPh7DhLpQbfnnTYWQoZGO/s/0PqKgUHR9DCidnnIPGfVWGZF Xjp0NqWzRnF0H9vZ4AN4noHGwjKejqO1isOGWKL2jMmYfk1AmzMg/JyMb4HpXPrKr/9x 5kCZuIeuJe/IQdgg8VaVONTEASl8S1O01e6nk= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:sender:date:from:to:cc:subject:message-id :mail-followup-to:references:mime-version:content-disposition :content-transfer-encoding:in-reply-to:user-agent; bh=PuKQ8hH6y557F/cTz1BUH8YZIfFjDAInl9RUr2d/iIg=; b=rfqqDlRJDt1db01PzTebyLdcST4xtcZbusfDI9mJ7Dwpax7rurAIhcATc4cV8gfNOW OIqv9P/DsAD3ASqk0otjOvUl2y/QfwsQBUXw6V3KoI72f38YDV7WZbz1y1UfvptAhkLX /HOg/F7BSOzDpe7Dhvd+OWR/1p7Zxug8K7Ybl+3TvANig1ZvrW010lcf2qEDuV011d14 3Y60mG+cPFhCp4svJBeJn+Sr21aRj8QhFSMD45diIvEBTxlmhedMW+7hh1HgkyLOnU+7 dEAQy2DhI1hO/jlUoSM8N3mYUmJzNFvSqe/LYt56QRhTmNLb0UjLGxDAC73vM31tm1+0 CGUQ== X-Gm-Message-State: ALQs6tA3Oi76o0R/YtsFbu15FaYmb7+eWPdZjF9YyPyPbPeAtCWYwrxa OrdThTIjYg1HQsZKfl0JlLJP4Q== X-Received: by 10.80.168.69 with SMTP id j63mr12221865edc.210.1524208757953; Fri, 20 Apr 2018 00:19:17 -0700 (PDT) Received: from phenom.ffwll.local ([2a02:168:5635:0:39d2:f87e:2033:9f6]) by smtp.gmail.com with ESMTPSA id e24sm1650006edc.80.2018.04.20.00.19.16 (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Fri, 20 Apr 2018 00:19:16 -0700 (PDT) Date: Fri, 20 Apr 2018 09:19:14 +0200 From: Daniel Vetter To: Roger Pau =?iso-8859-1?Q?Monn=E9?= Cc: Oleksandr Andrushchenko , jgross@suse.com, Artem Mygaiev , Dongwon Kim , konrad.wilk@oracle.com, airlied@linux.ie, "Oleksandr_Andrushchenko@epam.com" , linux-kernel@vger.kernel.org, dri-devel@lists.freedesktop.org, "Potrola, MateuszX" , xen-devel@lists.xenproject.org, daniel.vetter@intel.com, boris.ostrovsky@oracle.com Subject: Re: [Xen-devel] [PATCH 0/1] drm/xen-zcopy: Add Xen zero-copy helper DRM driver Message-ID: <20180420071914.GG31310@phenom.ffwll.local> Mail-Followup-To: Roger Pau =?iso-8859-1?Q?Monn=E9?= , Oleksandr Andrushchenko , jgross@suse.com, Artem Mygaiev , Dongwon Kim , konrad.wilk@oracle.com, airlied@linux.ie, "Oleksandr_Andrushchenko@epam.com" , linux-kernel@vger.kernel.org, dri-devel@lists.freedesktop.org, "Potrola, MateuszX" , xen-devel@lists.xenproject.org, daniel.vetter@intel.com, boris.ostrovsky@oracle.com References: <20180329131931.29957-1-andr2000@gmail.com> <5d8fec7f-956c-378f-be90-f45029385740@gmail.com> <20180416192905.GA18096@downor-Z87X-UD5H> <20180417075928.GT31310@phenom.ffwll.local> <20180417205744.GA15930@downor-Z87X-UD5H> <41487acb-a67a-8933-d0c3-702c19b0938e@gmail.com> <20180418073508.ptvntwedczpvl7bx@MacBook-Pro-de-Roger.local> <20180418101058.hyqk3gr3b2ibxswu@MacBook-Pro-de-Roger.local> MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <20180418101058.hyqk3gr3b2ibxswu@MacBook-Pro-de-Roger.local> X-Operating-System: Linux phenom 4.15.0-1-amd64 User-Agent: Mutt/1.9.4 (2018-02-28) Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Wed, Apr 18, 2018 at 11:10:58AM +0100, Roger Pau Monn? wrote: > On Wed, Apr 18, 2018 at 11:01:12AM +0300, Oleksandr Andrushchenko wrote: > > On 04/18/2018 10:35 AM, Roger Pau Monn? wrote: > > > On Wed, Apr 18, 2018 at 09:38:39AM +0300, Oleksandr Andrushchenko wrote: > > > > On 04/17/2018 11:57 PM, Dongwon Kim wrote: > > > > > On Tue, Apr 17, 2018 at 09:59:28AM +0200, Daniel Vetter wrote: > > > > > > On Mon, Apr 16, 2018 at 12:29:05PM -0700, Dongwon Kim wrote: > > > > 3.2 Backend exports dma-buf to xen-front > > > > > > > > In this case Dom0 pages are shared with DomU. As before, DomU can only write > > > > to these pages, not any other page from Dom0, so it can be still considered > > > > safe. > > > > But, the following must be considered (highlighted in xen-front's Kernel > > > > documentation): > > > > ?- If guest domain dies then pages/grants received from the backend cannot > > > > ?? be claimed back - think of it as memory lost to Dom0 (won't be used for > > > > any > > > > ?? other guest) > > > > ?- Misbehaving guest may send too many requests to the backend exhausting > > > > ?? its grant references and memory (consider this from security POV). As the > > > > ?? backend runs in the trusted domain we also assume that it is trusted as > > > > well, > > > > ?? e.g. must take measures to prevent DDoS attacks. > > > I cannot parse the above sentence: > > > > > > "As the backend runs in the trusted domain we also assume that it is > > > trusted as well, e.g. must take measures to prevent DDoS attacks." > > > > > > What's the relation between being trusted and protecting from DoS > > > attacks? > > I mean that we trust the backend that it can prevent Dom0 > > from crashing in case DomU's frontend misbehaves, e.g. > > if the frontend sends too many memory requests etc. > > > In any case, all? PV protocols are implemented with the frontend > > > sharing pages to the backend, and I think there's a reason why this > > > model is used, and it should continue to be used. > > This is the first use-case above. But there are real-world > > use-cases (embedded in my case) when physically contiguous memory > > needs to be shared, one of the possible ways to achieve this is > > to share contiguous memory from Dom0 to DomU (the second use-case above) > > > Having to add logic in the backend to prevent such attacks means > > > that: > > > > > > - We need more code in the backend, which increases complexity and > > > chances of bugs. > > > - Such code/logic could be wrong, thus allowing DoS. > > You can live without this code at all, but this is then up to > > backend which may make Dom0 down because of DomU's frontend doing evil > > things > > IMO we should design protocols that do not allow such attacks instead > of having to defend against them. > > > > > 4. xen-front/backend/xen-zcopy synchronization > > > > > > > > 4.1. As I already said in 2) all the inter VM communication happens between > > > > xen-front and the backend, xen-zcopy is NOT involved in that. > > > > When xen-front wants to destroy a display buffer (dumb/dma-buf) it issues a > > > > XENDISPL_OP_DBUF_DESTROY command (opposite to XENDISPL_OP_DBUF_CREATE). > > > > This call is synchronous, so xen-front expects that backend does free the > > > > buffer pages on return. > > > > > > > > 4.2. Backend, on XENDISPL_OP_DBUF_DESTROY: > > > > ? - closes all dumb handles/fd's of the buffer according to [3] > > > > ? - issues DRM_IOCTL_XEN_ZCOPY_DUMB_WAIT_FREE IOCTL to xen-zcopy to make > > > > sure > > > > ??? the buffer is freed (think of it as it waits for dma-buf->release > > > > callback) > > > So this zcopy thing keeps some kind of track of the memory usage? Why > > > can't the user-space backend keep track of the buffer usage? > > Because there is no dma-buf UAPI which allows to track the buffer life cycle > > (e.g. wait until dma-buf's .release callback is called) > > > > ? - replies to xen-front that the buffer can be destroyed. > > > > This way deletion of the buffer happens synchronously on both Dom0 and DomU > > > > sides. In case if DRM_IOCTL_XEN_ZCOPY_DUMB_WAIT_FREE returns with time-out > > > > error > > > > (BTW, wait time is a parameter of this IOCTL), Xen will defer grant > > > > reference > > > > removal and will retry later until those are free. > > > > > > > > Hope this helps understand how buffers are synchronously deleted in case > > > > of xen-zcopy with a single protocol command. > > > > > > > > I think the above logic can also be re-used by the hyper-dmabuf driver with > > > > some additional work: > > > > > > > > 1. xen-zcopy can be split into 2 parts and extend: > > > > 1.1. Xen gntdev driver [4], [5] to allow creating dma-buf from grefs and > > > > vise versa, > > > I don't know much about the dma-buf implementation in Linux, but > > > gntdev is a user-space device, and AFAICT user-space applications > > > don't have any notion of dma buffers. How are such buffers useful for > > > user-space? Why can't this just be called memory? > > A dma-buf is seen by user-space as a file descriptor and you can > > pass it to different drivers then. For example, you can share a buffer > > used by a display driver for scanout with a GPU, to compose a picture > > into it: > > 1. User-space (US) allocates a display buffer from display driver > > 2. US asks display driver to export the dma-buf which backs up that buffer, > > US gets buffer's fd: dma_buf_fd > > 3. US asks GPU driver to import a buffer and provides it with dma_buf_fd > > 4. GPU renders contents into display buffer (dma_buf_fd) > > After speaking with Oleksandr on IRC, I think the main usage of the > gntdev extension is to: > > 1. Create a dma-buf from a set of grant references. > 2. Share dma-buf and get a list of grant references. > > I think this set of operations could be broken into: > > 1.1 Map grant references into user-space using the gntdev. > 1.2 Create a dma-buf out of a set of user-space virtual addresses. > > 2.1 Map a dma-buf into user-space. > 2.2 Get grefs out of the user-space addresses where the dma-buf is > mapped. > > So it seems like what's actually missing is a way to: > > - Create a dma-buf from a list of user-space virtual addresses. > - Allow to map a dma-buf into user-space, so it can then be used with > the gntdev. > > I think this is generic enough that it could be implemented by a > device not tied to Xen. AFAICT the hyper_dma guys also wanted > something similar to this. You can't just wrap random userspace memory into a dma-buf. We've just had this discussion with kvm/qemu folks, who proposed just that, and after a bit of discussion they'll now try to have a driver which just wraps a memfd into a dma-buf. Yes i915 and amdgpu and a few other drivers do have facilities to wrap userspace memory into a gpu buffer object. But we don't allow those to be exported to other drivers, because the core mm magic needed to make this all work is way too tricky, even within the context of just 1 driver. And dma-buf does not have the required callbacks and semantics to make it work. -Daniel > > > Finally, this is indeed some memory, but a bit more [1] > > > > > > Also, (with my FreeBSD maintainer hat) how is this going to translate > > > to other OSes? So far the operations performed by the gntdev device > > > are mostly OS-agnostic because this just map/unmap memory, and in fact > > > they are implemented by Linux and FreeBSD. > > At the moment I can only see Linux implementation and it seems > > to be perfectly ok as we do not change Xen's APIs etc. and only > > use the existing ones (remember, we only extend gntdev/balloon > > drivers, all the changes in the Linux kernel) > > As the second note I can also think that we do not extend gntdev/balloon > > drivers and have re-worked xen-zcopy driver be a separate entity, > > say drivers/xen/dma-buf > > > > implement "wait" ioctl (wait for dma-buf->release): currently these are > > > > DRM_XEN_ZCOPY_DUMB_FROM_REFS, DRM_XEN_ZCOPY_DUMB_TO_REFS and > > > > DRM_XEN_ZCOPY_DUMB_WAIT_FREE > > > > 1.2. Xen balloon driver [6] to allow allocating contiguous buffers (not > > > > needed > > > > by current hyper-dmabuf, but is a must for xen-zcopy use-cases) > > > I think this needs clarifying. In which memory space do you need those > > > regions to be contiguous? > > Use-case: Dom0 has a HW driver which only works with contig memory > > and I want DomU to be able to directly write into that memory, thus > > implementing zero copying > > > > > > Do they need to be contiguous in host physical memory, or guest > > > physical memory? > > Host > > > > > > If it's in guest memory space, isn't there any generic interface that > > > you can use? > > > > > > If it's in host physical memory space, why do you need this buffer to > > > be contiguous in host physical memory space? The IOMMU should hide all > > > this. > > There are drivers/HW which can only work with contig memory and > > if it is backed by an IOMMU then still it has to be contig in IPA > > space (real device doesn't know that it is actually IPA contig, not PA) > > What's IPA contig? > > Thanks, Roger. > _______________________________________________ > dri-devel mailing list > dri-devel@lists.freedesktop.org > https://lists.freedesktop.org/mailman/listinfo/dri-devel -- Daniel Vetter Software Engineer, Intel Corporation http://blog.ffwll.ch