Design session "grant v3"

[Marek Marczykowski-Górecki <marmarek@xxxxxxxxxxxxxxxxxxxxxx>]

Jürgen: today two grants formats, v1 supports only up to 16TB addresses
        v2 solves 16TB issue, introduces several more features^Wbugs
        v2 is 16 bytes per entry, v1 is 8 bytes per entry, v2 more complicated 
interface to the hypervisor
        virtio could use per-device grant table, currently virtio iommu device, 
slow interface
        v3 could be a grants tree (like iommu page tables), not flat array, 
separate trees for each grantee
        could support sharing large pages too
        easier to have more grants, continuous grant numbers etc
        two options to distingush trees (from HV PoV):
        - sharing guest ensure distinct grant ids between (multiple) trees
        - hv tells guest index under tree got registered
        v3 can be addition to v1/v2, old used for simpler cases where tree is 
an overkill
        hypervisor needs extra memory to keep refcounts - resource allocation 
discussion
        hv could have TLB to speedup mapping
        issue with v1/v2 - granter cannot revoke pages from uncooperating 
backend
        tree could have special page for revoking grants (redirect to that page)
        special domids, local to the guest, toolstack restaring backend could 
request to keep the same virtual domid
Marek:  that requires stateless (or recoverable) protocol, reusing domid 
currently causes issues
Andrei: how revoking could work
Jürgen: there needs to be hypercall, replacing and invalidating mapping (scan 
page tables?), possibly adjusting IOMMU etc; may fail, problematic for PV

Yann:   can backend refuse revoking?
Jürgen: it shouldn't be this way, but revoke could be controlled by feature 
flag; revoke could pass scratch page per revoke call (more flexible control)

Marek:  what about unmap notification?
Jürgen: revoke could even be async; ring page for unmap notifications

Marek:  downgrading mappings (rw -> ro)
Jürgen: must be careful, to not allow crashing backend

Jürgen: we should consider interface to mapping large pages ("map this area as 
a large page if backend shared it as large page")

Edwin:  what happens when shattering that large page?
Jürgen: on live migration pages are rebuilt anyway, can reconstruct large pages


-- 
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab

Attachment: signature.asc
Description: PGP signature