Re: [PATCH 2/7] guest_memfd: Introduce an object to manage the guest-memfd with RamDiscardManager

Peter Xu
2025-01-24T16:46:07Z

On Fri, Jan 24, 2025 at 05:47:45PM +0800, Xu Yilun wrote:
> On Thu, Jan 23, 2025 at 11:47:17AM -0500, Peter Xu wrote:
> > On Thu, Jan 23, 2025 at 05:33:53PM +0800, Xu Yilun wrote:
> > > On Wed, Jan 22, 2025 at 11:43:01AM -0500, Peter Xu wrote:
> > > > On Wed, Jan 22, 2025 at 05:41:31PM +0800, Xu Yilun wrote:
> > > > > On Wed, Jan 22, 2025 at 03:30:05PM +1100, Alexey Kardashevskiy wrote:
> > > > > >
> > > > > >
> > > > > > On 22/1/25 02:18, Peter Xu wrote:
> > > > > > > On Tue, Jun 25, 2024 at 12:31:13AM +0800, Xu Yilun wrote:
> > > > > > > > On Mon, Jan 20, 2025 at 03:46:15PM -0500, Peter Xu wrote:
> > > > > > > > > On Mon, Jan 20, 2025 at 09:22:50PM +1100, Alexey Kardashevskiy wrote:
> > > > > > > > > > > It is still uncertain how to implement the private MMIO. Our assumption
> > > > > > > > > > > is the private MMIO would also create a memory region with
> > > > > > > > > > > guest_memfd-like backend. Its mr->ram is true and should be managed by
> > > > > > > > > > > RamdDiscardManager which can skip doing DMA_MAP in VFIO's region_add
> > > > > > > > > > > listener.
> > > > > > > > > >
> > > > > > > > > > My current working approach is to leave it as is in QEMU and VFIO.
> > > > > > > > >
> > > > > > > > > Agreed. Setting ram=true to even private MMIO sounds hackish, at least
> > > > > > > >
> > > > > > > > The private MMIO refers to assigned MMIO, not emulated MMIO. IIUC,
> > > > > > > > normal assigned MMIO is always set ram=true,
> > > > > > > >
> > > > > > > > void memory_region_init_ram_device_ptr(MemoryRegion *mr,
> > > > > > > > Object *owner,
> > > > > > > > const char *name,
> > > > > > > > uint64_t size,
> > > > > > > > void *ptr)
> > > >
> > > > [1]
> > > >
> > > > > > > > {
> > > > > > > > memory_region_init(mr, owner, name, size);
> > > > > > > > mr->ram = true;
> > > > > > > >
> > > > > > > >
> > > > > > > > So I don't think ram=true is a problem here.
> > > > > > >
> > > > > > > I see. If there's always a host pointer then it looks valid. So it means
> > > > > > > the device private MMIOs are always mappable since the start?
> > > > > >
> > > > > > Yes. VFIO owns the mapping and does not treat shared/private MMIO any
> > > > > > different at the moment. Thanks,
> > > > >
> > > > > mm.. I'm actually expecting private MMIO not have a host pointer, just
> > > > > as private memory do.
> > > > >
> > > > > But I'm not sure why having host pointer correlates mr->ram == true.
> > > >
> > > > If there is no host pointer, what would you pass into "ptr" as referenced
> > > > at [1] above when creating the private MMIO memory region?
> > >
> > > Sorry for confusion. I mean existing MMIO region use set mr->ram = true,
> > > and unmappable region (gmem) also set mr->ram = true. So don't know why
> > > mr->ram = true for private MMIO is hackish.
> >
> > That's exactly what I had on the question in the previous email - please
> > have a look at what QEMU does right now with memory_access_is_direct().
>
> I see memory_access_is_direct() should exclude mr->ram_device == true, which
> is the case for normal assigned MMIO and for private assigned MMIO. So
> this func is not a problem.

I'm not sure even if so.

VFIO's current use case is pretty special - it still has a host pointer,
it's just that things like memcpy() might not be always suitable to be
applied on MMIO mapped regions. Alex explained the rational in commit
4a2e242bbb3. I mean, the host pointer is valid even if ram_device=true in
this case. Even if no direct access allowed (memcpy, etc.) it still
operates on the host address using ram_device_mem_ops.

>
> But I think flatview_access_allowed() is a problem that it doesn't filter
> out the private memory. When memory is converted to private, the result
> of host access can't be what you want and should be errored out. IOW,
> the host ptr is sometimes invalid.
>
> > I'm not 100% sure it'll work if the host pointer doesn't exist.
> >
> > Let's take one user of it to be explicit: flatview_write_continue_step()
> > will try to access the ram pointer if it's direct:
> >
> > if (!memory_access_is_direct(mr, true)) {
> > ...
> > } else {
> > /* RAM case */
> > uint8_t *ram_ptr = qemu_ram_ptr_length(mr->ram_block, mr_addr, l,
> > false, true);
> >
> > memmove(ram_ptr, buf, *l);
> > invalidate_and_set_dirty(mr, mr_addr, *l);
> >
> > return MEMTX_OK;
> > }
> >
> > I don't see how QEMU could work yet if one MR set ram=true but without a
> > host pointer..
> >
> > As discussed previously, IMHO it's okay that the pointer is not accessible,
>
> Maybe I missed something in previous discussion, I assume it is OK cause
> no address_space_rw is happening on this host ptr when memory is
> private, is it?

Yes, and when there is a mapped host address and someone tries to access an
address that is bound to a private page, QEMU should get a SIGBUS. This
code is not ready yet for gmem, but I believe it'll work like that when
in-place gmem folio conversions will be ready. So far QEMU's gmem works by
providing two layers of memory backends, which is IMHO pretty tricky.

>
> > but still I assume QEMU assumes the pointer at least existed for a ram=on
> > MR. I don't know whether it's suitable to set ram=on if the pointer
> > doesn't ever exist.
>
> In theory, any code logic should not depends on an invalid pointer. I
> think a NULL pointer would be much better than a invalid pointer, at
> least you can check whether to access. So if you think an invalid
> pointer is OK, a NULL pointer should be also OK.

Definitely not suggesting to install an invalid pointer anywhere. The
mapped pointer will still be valid for gmem for example, but the fault
isn't. We need to differenciate two things (1) virtual address mapping,
then (2) permission and accesses on the folios / pages of the mapping.
Here I think it's okay if the host pointer is correctly mapped.

For your private MMIO use case, my question is if there's no host pointer
to be mapped anyway, then what's the benefit to make the MR to be ram=on?
Can we simply make it a normal IO memory region? The only benefit of a
ram=on MR is, IMHO, being able to be accessed as RAM-like. If there's no
host pointer at all, I don't yet understand how that helps private MMIO
from working.

Thanks,

--
Peter Xu