Re: [PATCH 01/10] xen/arm: introduce domain on Static Allocation

[Julien Grall <julien@xxxxxxx>]

Hi Stefano,

On 04/06/2021 00:55, Stefano Stabellini wrote:
> On Thu, 3 Jun 2021, Julien Grall wrote:
> > On Thu, 3 Jun 2021 at 22:33, Stefano Stabellini <sstabellini@xxxxxxxxxx> wrote:
> > > On Thu, 3 Jun 2021, Julien Grall wrote:
> > > > On 02/06/2021 11:09, Penny Zheng wrote:
> > > > > I could not think a way to fix it properly in codes, do you have any
> > > > > suggestion? Or we just put a warning in doc/commits.
> > > > The correct approach is to find the parent of staticmemdomU1 (i.e.
> > > > reserved-memory) and use the #address-cells and #size-cells from there.
> > > Julien is right about how to parse the static-memory.
> > >
> > > But I have a suggestion on the new binding. The /reserved-memory node is
> > > a weird node: it is one of the very few node (the only node aside from
> > > /chosen) which is about software configurations rather than hardware
> > > description.
> > >
> > > For this reason, in a device tree with multiple domains /reserved-memory
> > > doesn't make a lot of sense: for which domain is the memory reserved?
> > IHMO, /reserved-memory refers to the memory that the hypervisor should
> > not touch. It is just a coincidence that most of the domains are then
> > passed through to dom0.
> >
> > This also matches the fact that the GIC, /memory is consumed by the
> > hypervisor directly and not the domain..
> In system device tree one of the key principles is to distinguish between
> hardware description and domains configuration. The domains
> configuration is under /domains (originally it was under /chosen then
> the DT maintainers requested to move it to its own top-level node), while
> everything else is for hardware description.
>
> /chosen and /reserved-memory are exceptions. They are top-level nodes
> but they are for software configurations. In system device tree
> configurations go under the domain node. This makes sense: Xen, dom0 and
> domU can all have different reserved-memory and chosen configurations.
>
> /domains/domU1/reserved-memory gives us a clear way to express
> reserved-memory configurations for domU1.
>
> Which leaves us with /reserved-memory. Who is that for? It is for the
> default domain.
>
> The default domain is the one receiving all devices by default. In a Xen
> setting, it is probably Dom0. 
Let's take an example, let say in the future someone wants to allocate a 
specific region for the memory used by the GICv3 ITS.
From what you said above, /reserved-memory would be used by dom0. So 
how would you be able to tell the hypervisor that the region is reserved 
for itself?
> In this case, we don't want to add
> reserved-memory regions for DomUs to Dom0's list. Dom0's reserved-memory
> list is for its own drivers. We could also make an argument that the
> default domain is Xen itself. From a spec perspective, that would be
> fine too. In this case, /reserved-memory is a list of memory regions
> reserved for Xen drivers. 
We seem to have a different way to read the binding description in [1]. 
For convenience, I will copy it here:
"Reserved memory is specified as a node under the /reserved-memory node.
The operating system shall exclude reserved memory from normal usage
one can create child nodes describing particular reserved (excluded from
normal use) memory regions. Such memory regions are usually designed for
the special usage by various device drivers.
"

I read it as this can be used to exclude any memory from the allocator 
for a specific purpose. They give the example of device drivers, but 
they don't exclude other purpose. So...
> Either way, I don't think is a great fit for
> domains memory allocations.
... I don't really understand why this is not a great fit. The regions 
have been *reserved* for a purpose.
> > > So I don't think we want to use reserved-memory for this, either
> > > /reserved-memory or /chosen/domU1/reserved-memory. Instead it would be
> > > good to align it with system device tree and define it as a new property
> > > under domU1.
> > Do you have any formal documentation of the system device-tree?
> It lives here:
> https://github.com/devicetree-org/lopper/tree/master/specification
>
> Start from specification.md. It is the oldest part of the spec, so it is
> not yet written with a formal specification language.
>
> FYI there are a number of things in-flight in regards to domains that
> we discussed in the last call but they are not yet settled, thus, they
> are not yet committed (access flags definitions and hierarchical
> domains). However, they don't affect domains memory allocations so from
> that perspective nothing has changed.
Thanks!

> > > In system device tree we would use a property called "memory" to specify
> > > one or more ranges, e.g.:
> > >
> > >      domU1 {
> > >          memory = <0x0 0x500000 0x0 0x7fb00000>;
> > >
> > > Unfortunately for xen,domains we have already defined "memory" to
> > > specify an amount, rather than a range. That's too bad because the most
> > > natural way to do this would be:
> > >
> > >      domU1 {
> > >          size = <amount>;
> > >          memory = <ranges>;
> > >
> > > When we'll introduce native system device tree support in Xen we'll be
> > > able to do that. For now, we need to come up with a different property.
> > > For instance: "static-memory" (other names are welcome if you have a
> > > better suggestion).
> > >
> > > We use a new property called "static-memory" together with
> > > #static-memory-address-cells and #static-memory-size-cells to define how
> > > many cells to use for address and size.
> > >
> > > Example:
> > >
> > >      domU1 {
> > >          #static-memory-address-cells = <2>;
> > >          #static-memory-size-cells = <2>;
> > >          static-memory = <0x0 0x500000 0x0 0x7fb00000>;
> > This is pretty similar to what Penny suggested. But I dislike it
> > because of the amount of code that needs to be duplicated with the
> > reserved memory.
> Where is the code duplication? In the parsing itself?
So the problem is we need an entire new way to parse and walk yet 
another binding that will describe memory excluded from normal allocator 
hypervisor.
The code is pretty much the same as parsing /reserved-memory except it 
will be on a different address cells, size cells, property.
> If there is code duplication, can we find a way to share some of the
> code to avoid the duplication?
Feel free to propose one. I suggested to use /reserved-memory because 
this is the approach that makes the most sense to me (see my reply above).
TBH, even after your explanation, I am still a bit puzzled into why 
/reserved-memory cannot be leveraged to exclude domain region from the 
hypervisor allocator.
Cheers,

[1] 
https://www.kernel.org/doc/Documentation/devicetree/bindings/reserved-memory/reserved-memory.txt
--
Julien Grall