> From: Liu, Yi L <yi.l.liu@xxxxxxxxx> > Sent: Monday, February 6, 2023 5:05 PM > > Allow the vfio_device file to be in a state where the device FD is > opened but the device cannot be used by userspace (i.e. its .open_device() > hasn't been called). This inbetween state is not used when the device > FD is spawned from the group FD, however when we create the device FD > directly by opening a cdev it will be opened in the blocked state. > > The reason for the inbetween state is userspace only gets a FD but ...is "that" userspace... > doesn't have the secure until binding the FD to an iommufd. So in the "doesn't gain access permission until..." > blocked state, only the bind operation is allowed, other device accesses remove the last part which duplicates with "only ... is allowed" > are not allowed. Completing bind will allow user to further access the > device. > > This is implemented by adding a flag in struct vfio_device_file to mark > the blocked state and using a simple smp_load_acquire() to obtain the > flag value and serialize all the device setup with the thread accessing > this device. > > Following this lockless scheme, it can safely handle the device FD > unbound->bound but it cannot handle bound->unbound. To allow this we'd > need to add a lock on all the vfio ioctls which seems costly. So once > device FD is bound, it remains bound until the FD is closed. > > Suggested-by: Jason Gunthorpe <jgg@xxxxxxxxxx> > Signed-off-by: Yi Liu <yi.l.liu@xxxxxxxxx> Reviewed-by: Kevin Tian <kevin.tian@xxxxxxxxx>
