[Intel-gfx] [PATCH v2 07/14] vfio: Block device access via device fd until device is opened

[Tian, Kevin]

> From: Liu, Yi L <yi.l.liu at intel.com>
> Sent: Monday, February 6, 2023 5:05 PM
> 
> Allow the vfio_device file to be in a state where the device FD is
> opened but the device cannot be used by userspace (i.e. its .open_device()
> hasn't been called). This inbetween state is not used when the device
> FD is spawned from the group FD, however when we create the device FD
> directly by opening a cdev it will be opened in the blocked state.
> 
> The reason for the inbetween state is userspace only gets a FD but

...is "that" userspace...

> doesn't have the secure until binding the FD to an iommufd. So in the

"doesn't gain access permission until..."

> blocked state, only the bind operation is allowed, other device accesses

remove the last part which duplicates with "only ... is allowed"

> are not allowed. Completing bind will allow user to further access the
> device.
> 
> This is implemented by adding a flag in struct vfio_device_file to mark
> the blocked state and using a simple smp_load_acquire() to obtain the
> flag value and serialize all the device setup with the thread accessing
> this device.
> 
> Following this lockless scheme, it can safely handle the device FD
> unbound->bound but it cannot handle bound->unbound. To allow this we'd
> need to add a lock on all the vfio ioctls which seems costly. So once
> device FD is bound, it remains bound until the FD is closed.
> 
> Suggested-by: Jason Gunthorpe <jgg at nvidia.com>
> Signed-off-by: Yi Liu <yi.l.liu at intel.com>

Reviewed-by: Kevin Tian <kevin.tian at intel.com>