On Fri, Jun 06, 2025 at 03:02:49PM +0530, Aneesh Kumar K.V wrote:

Jason Gunthorpe jgg@nvidia.com writes:

...

On Thu, Jun 05, 2025 at 09:47:01PM +0530, Aneesh Kumar K.V wrote:

...

Jason Gunthorpe jgg@nvidia.com writes:

...

On Thu, Jun 05, 2025 at 05:33:52PM +0530, Aneesh Kumar K.V wrote:

...

...

• /* To ensure no host side MMIO access is possible */
• ret = pci_request_regions_exclusive(pdev, "vfio-pci-tsm");
• if (ret)

• goto out_unlock;
  

I am hitting failures here with similar changes. Can you share the Qemu changes needed to make this pci_request_regions_exclusive successful. Also after the TDI is unbound, we want the region ownership backto "vfio-pci" so that things continue to work as non-secure device. I don't see we doing that. I could add a pci_bar_deactivate/pci_bar_activate in userspace which will result in vfio_unmap()/vfio_map(). But that doesn't release the region ownership.

Again, IMHO, we should not be doing this dynamically. VFIO should do pci_request_regions_exclusive() once at the very start and it should stay that way.

There is no reason to change it dynamically.

The only decision to make is if all vfio should switch to exclusive mode or if we need to make it optional for userspace.

We only need the exclusive mode when the device is operating in secure mode, correct? That suggests we’ll need to dynamically toggle this setting based on the device’s security state.

No, if the decision is that VFIO should allow this to be controlled by userspace then userspace will tell iommufd to run in regions_exclusive mode prior to opening the vfio cdev and VFIO will still do it once at open time and never change it.

So this will be handled by setting vdevice::flags = IOMMUFD_PCI_REGION_EXCLUSIVE in

Not like that.. I would suggest a global vfio sysfs or module parameter, or maybe a iommufd ictx global option:

IOMMU_OPTION(IOMMU_OPTION_OP_SET, IOMMU_OPTION_EXCLUSIVE_RANGES)

You want something simple here, not tied to vdevice or very dynamic.

The use cases for non-exclusive ranges are very narrow, IMHO

and vfio_pci_core_mmap() will do

if (!vdev->barmap[index]) {

if (core_vdev->iommufd_device &&
    iommufd_vdevice_region_exclusive(core_vdev->iommufd_device))
	ret = pci_request_selected_regions_exclusive(pdev,
					1 << index, "vfio-pci");
else
	ret = pci_request_selected_regions(pdev,
				1 << index, "vfio-pci");

And IMHO, these should be moved to probe time or at least FD open time, not at mmap time...

Jason