Re: [PATCH 01/10] xen/arm: introduce domain on Static Allocation

[Bertrand Marquis <Bertrand.Marquis@xxxxxxx>]

Hi All,

On 7 Jun 2021, at 19:09, Julien Grall <julien@xxxxxxx> wrote:

Hi Stefano,

On 04/06/2021 00:55, Stefano Stabellini wrote:

On Thu, 3 Jun 2021, Julien Grall wrote:

On Thu, 3 Jun 2021 at 22:33, Stefano Stabellini <sstabellini@xxxxxxxxxx> wrote:

On Thu, 3 Jun 2021, Julien Grall wrote:

On 02/06/2021 11:09, Penny Zheng wrote:

I could not think a way to fix it properly in codes, do you have any
suggestion? Or we just put a warning in doc/commits.

The correct approach is to find the parent of staticmemdomU1 (i.e.
reserved-memory) and use the #address-cells and #size-cells from there.

Julien is right about how to parse the static-memory.

But I have a suggestion on the new binding. The /reserved-memory node is
a weird node: it is one of the very few node (the only node aside from
/chosen) which is about software configurations rather than hardware
description.

For this reason, in a device tree with multiple domains /reserved-memory
doesn't make a lot of sense: for which domain is the memory reserved?

IHMO, /reserved-memory refers to the memory that the hypervisor should
not touch. It is just a coincidence that most of the domains are then
passed through to dom0.

This also matches the fact that the GIC, /memory is consumed by the
hypervisor directly and not the domain..

In system device tree one of the key principles is to distinguish between
hardware description and domains configuration. The domains
configuration is under /domains (originally it was under /chosen then
the DT maintainers requested to move it to its own top-level node), while
everything else is for hardware description.
/chosen and /reserved-memory are exceptions. They are top-level nodes
but they are for software configurations. In system device tree
configurations go under the domain node. This makes sense: Xen, dom0 and
domU can all have different reserved-memory and chosen configurations.
/domains/domU1/reserved-memory gives us a clear way to express
reserved-memory configurations for domU1.
Which leaves us with /reserved-memory. Who is that for? It is for the
default domain.
The default domain is the one receiving all devices by default. In a Xen
setting, it is probably Dom0. 

Let's take an example, let say in the future someone wants to allocate a specific region for the memory used by the GICv3 ITS.

From what you said above, /reserved-memory would be used by dom0. So how would you be able to tell the hypervisor that the region is reserved for itself?

In this case, we don't want to add
reserved-memory regions for DomUs to Dom0's list. Dom0's reserved-memory
list is for its own drivers. We could also make an argument that the
default domain is Xen itself. From a spec perspective, that would be
fine too. In this case, /reserved-memory is a list of memory regions
reserved for Xen drivers. 

We seem to have a different way to read the binding description in [1]. For convenience, I will copy it here:

"Reserved memory is specified as a node under the /reserved-memory node.
The operating system shall exclude reserved memory from normal usage
one can create child nodes describing particular reserved (excluded from
normal use) memory regions. Such memory regions are usually designed for
the special usage by various device drivers.
"

I read it as this can be used to exclude any memory from the allocator for a specific purpose. They give the example of device drivers, but they don't exclude other purpose. So...

Either way, I don't think is a great fit for
domains memory allocations.

... I don't really understand why this is not a great fit. The regions have been *reserved* for a purpose.

So I don't think we want to use reserved-memory for this, either
/reserved-memory or /chosen/domU1/reserved-memory. Instead it would be
good to align it with system device tree and define it as a new property
under domU1.

Do you have any formal documentation of the system device-tree?

It lives here:
https://github.com/devicetree-org/lopper/tree/master/specification
Start from specification.md. It is the oldest part of the spec, so it is
not yet written with a formal specification language.
FYI there are a number of things in-flight in regards to domains that
we discussed in the last call but they are not yet settled, thus, they
are not yet committed (access flags definitions and hierarchical
domains). However, they don't affect domains memory allocations so from
that perspective nothing has changed.

Thanks!

In system device tree we would use a property called "memory" to specify
one or more ranges, e.g.:

    domU1 {
        memory = <0x0 0x500000 0x0 0x7fb00000>;

Unfortunately for xen,domains we have already defined "memory" to
specify an amount, rather than a range. That's too bad because the most
natural way to do this would be:

    domU1 {
        size = <amount>;
        memory = <ranges>;

When we'll introduce native system device tree support in Xen we'll be
able to do that. For now, we need to come up with a different property.
For instance: "static-memory" (other names are welcome if you have a
better suggestion).

We use a new property called "static-memory" together with
#static-memory-address-cells and #static-memory-size-cells to define how
many cells to use for address and size.

Example:

    domU1 {
        #static-memory-address-cells = <2>;
        #static-memory-size-cells = <2>;
        static-memory = <0x0 0x500000 0x0 0x7fb00000>;

This is pretty similar to what Penny suggested. But I dislike it
because of the amount of code that needs to be duplicated with the
reserved memory.

Where is the code duplication? In the parsing itself?

So the problem is we need an entire new way to parse and walk yet another binding that will describe memory excluded from normal allocator hypervisor.

The code is pretty much the same as parsing /reserved-memory except it will be on a different address cells, size cells, property.

If there is code duplication, can we find a way to share some of the
code to avoid the duplication?

Feel free to propose one. I suggested to use /reserved-memory because this is the approach that makes the most sense to me (see my reply above).

TBH, even after your explanation, I am still a bit puzzled into why /reserved-memory cannot be leveraged to exclude domain region from the hypervisor allocator.

I really tend to think that the original solution from Penny is for now the easiest and simplest to document.

In the long term, using directly memory and giving in it the address range directly is the most natural solution but that would clash with the current usage for it.

I would like to suggest the following approach:

- keep original solution from Penny

- start to discuss a domain v2 so that we could solve current issues we have including the passthrough devices which are not really easy to define. 

As a user I would just expect to put a device tree or links in a domain definition to define its characteristic and devices and using the standard names (memory for example).

Also I must admit I need to read more the system device tree spec to check if we could just use it directly (and be compliant to a standard).

Would that approach be acceptable ?

I am more then happy to drive a working group on rethinking the device tree together with Penny.

Cheers

Bertrand

Cheers,

[1] https://www.kernel.org/doc/Documentation/devicetree/bindings/reserved-memory/reserved-memory.txt

-- 
Julien Grall