Re: [PATCH][VT-d] Dis-allow PCI device assignment if PoD is enabled

[George Dunlap <george.dunlap@eu.citrix.com>]

Seems like a good "seatbelt" for 4.0.

Looking forward, what would it take to make PoD and VT-d coexist?  We 
only need PoD during boot, until the balloon driver comes up and 
balloons down the guest's memory.  Three solutions come to mind, but as 
I don't know the constraints of VT-d, I don't know which is feasible (if 
any):
* Redo the VT-d mapping every time the p2m map changes as a result of PoD.
* While PoD pages exist, intercept device commands, and redo the VT-d 
map if the page was marked PoD the last time we updated the VT-d map
* Detect DMA faults, instantiate the page if necessary, update the VT-d 
map, and re-start the transaction.

How expensive is it to change the VT-d pagetable?  Is a DMA fault 
re-startable?  i.e., could we take a fault, redo the VT-d map, and 
re-issue the DMA request?

 -George

Xu, Dongxiao wrote:
> It seems that currently we don't have any code to handle
> the coexistence of VT-d and PoD. VT-d engine needs to set up
> the entire page table for the domain. However if PoD is enabled,
> un-populated memory is marked as populate_on_demand, and
> VT-d engine won't set up page tables for them. Therefore any
> DMA towards those memory may cause DMA fault.
> 	So for safety concern, its better to dis-allow PCI device
> assignment if PoD is enabled.
>
> Best Regards, 
> -- Dongxiao
>