Re: [PATCH v3 07/24] xen/arm: Introduce xen, passthrough property

[Ian Campbell <ian.campbell@citrix.com>]

On Tue, 2015-01-13 at 14:25 +0000, Julien Grall wrote:
> When a device is marked for passthrough (via the new property "xen,passthrough"),
> dom0 must not access to the device (i.e not loading a driver), but should

"must not access the device (i.e. not load a driver)"

perhaps "should still be able"

> be able to manage the MMIO/interrupt of the passthrough device.
> 
> The latter part will allow the toolstack to map MMIO/IRQ when a device
> is pass through to a guest.
> 
> The property "xen,passthrough" will be translated as 'status="disabled"'
> in the device tree to avoid DOM0 using the device. We assume that DOM0 is
> able to cope with this property (already the case for Linux).

Is it true to say "already the case for Linux, and required by ePAPR"?
Or are we relying on a Linux implementation detail here?

> diff --git a/docs/misc/arm/device-tree/passthrough.txt b/docs/misc/arm/device-tree/passthrough.txt
> new file mode 100644
> index 0000000..04645b3
> --- /dev/null
> +++ b/docs/misc/arm/device-tree/passthrough.txt
> @@ -0,0 +1,7 @@
> +Device passthrough
> +===================
> +
> +Any device that will be passthrough to a guest should have a property
> +"xen,passthrough" in their device tree node.
> +
> +The device won't be exposed to DOM0 and therefore no driver will be loaded.

This (and the commit message to some extent) seem stricter than what I
think is actually required here.

I understand that it is a very good idea for any sort of passthrough to
prevent dom0 from messing with a device before it gets assigned to the
eventual guest domain.

But AIUI it is not strictly speaking a hard requirement that dom0 does
not do this and depending on the device it may be perfectly acceptable
for dom0 to drive a device for a bit and then give it to a guest and
then have it back again etc.

So I would suggest to invert the wording a bit, currently it reads
something like "if a device is to be passed through then it must have
this property set, then dom0 will not touch".

So I'd suggest something weaker like:

        Devices with this property set will not be exposed to dom0 and
        therefore no driver will be loaded.
        
        It is highly recommended to set this property on devices which
        are to be passed through since many devices will not cope with
        being accessed by dom0 and then handed over to another domain.

(second half of the second paragraph could be clearer though I think)

(I'll hit send now and then review the code itself)