[{"id":1751256,"web_url":"http://patchwork.ozlabs.org/comment/1751256/","msgid":"<20170818160433.GN28977@bhelgaas-glaptop.roam.corp.google.com>","list_archive_url":null,"date":"2017-08-18T16:04:33","subject":"Re: [PATCH v2 4/4] iommu: Prevent VMD child devices from being\n\tremapping targets","submitter":{"id":67298,"url":"http://patchwork.ozlabs.org/api/people/67298/","name":"Bjorn Helgaas","email":"helgaas@kernel.org"},"content":"[+cc Robin]\n\nThis series looks fine to me as far as PCI is concerned, and I'd be\nhappy to take it via my tree given an ack from David for this IOMMU\npiece. Alternatively, you can add my\n\nAcked-by: Bjorn Helgaas \n\nto the other patches if you want to take it via another tree.\n\nRobin raised a question about basically this same patch the first time\naround. Not sure whether there's still an objection there.\n\nOn Thu, Aug 17, 2017 at 12:10:14PM -0600, Jon Derrick wrote:\n> VMD child devices must use the VMD endpoint's ID as the requester.\n> Because of this, there needs to be a way to link the parent VMD\n> endpoint's iommu group and associated mappings to the VMD child devices\n> such that attaching and detaching child devices modify the endpoint's\n> mappings, while preventing early detaching on a singular device removal\n> or unbinding.\n> \n> The reassignment of individual VMD child devices devices to VMs is\n> outside the scope of VMD, but may be implemented in the future. For now\n> it is best to prevent any such attempts.\n> \n> This patch prevents VMD child devices from returning an IOMMU, which\n> prevents it from exposing an iommu_group sysfs directories and allowing\n> subsequent binding by userspace-access drivers such as VFIO.\n> \n> Signed-off-by: Jon Derrick \n> ---\n> drivers/iommu/intel-iommu.c | 5 +++++\n> 1 file changed, 5 insertions(+)\n> \n> diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c\n> index 687f18f..94353a6e 100644\n> --- a/drivers/iommu/intel-iommu.c\n> +++ b/drivers/iommu/intel-iommu.c\n> @@ -901,6 +901,11 @@ static struct intel_iommu *device_to_iommu(struct device *dev, u8 *bus, u8 *devf\n> \t\tstruct pci_dev *pf_pdev;\n> \n> \t\tpdev = to_pci_dev(dev);\n> +\n> +\t\t/* VMD child devices currently cannot be handled individually */\n> +\t\tif (is_vmd(pdev->bus))\n> +\t\t\treturn NULL;\n> +\n> \t\t/* VFs aren't listed in scope tables; we need to look up\n> \t\t * the PF instead to find the IOMMU. */\n> \t\tpf_pdev = pci_physfn(pdev);\n> -- \n> 2.9.4\n>","headers":{"Return-Path":"","X-Original-To":"incoming@patchwork.ozlabs.org","Delivered-To":"patchwork-incoming@bilbo.ozlabs.org","Authentication-Results":["ozlabs.org;\n\tspf=none (mailfrom) smtp.mailfrom=vger.kernel.org\n\t(client-ip=209.132.180.67; helo=vger.kernel.org;\n\tenvelope-from=linux-pci-owner@vger.kernel.org;\n\treceiver=)","mail.kernel.org;\n\tdmarc=none (p=none dis=none) header.from=kernel.org","mail.kernel.org;\n\tspf=none smtp.mailfrom=helgaas@kernel.org"],"Received":["from vger.kernel.org (vger.kernel.org [209.132.180.67])\n\tby ozlabs.org (Postfix) with ESMTP id 3xYnwM6wkLz9t2c\n\tfor ;\n\tSat, 19 Aug 2017 02:04:51 +1000 (AEST)","(majordomo@vger.kernel.org) by vger.kernel.org via listexpand\n\tid S1752394AbdHRQEh (ORCPT );\n\tFri, 18 Aug 2017 12:04:37 -0400","from mail.kernel.org ([198.145.29.99]:46840 \"EHLO mail.kernel.org\"\n\trhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP\n\tid S1751107AbdHRQEf (ORCPT );\n\tFri, 18 Aug 2017 12:04:35 -0400","from localhost (unknown [69.71.4.159])\n\t(using TLSv1.2 with cipher DHE-RSA-AES128-SHA (128/128 bits))\n\t(No client certificate requested)\n\tby mail.kernel.org (Postfix) with ESMTPSA id E825D2394F;\n\tFri, 18 Aug 2017 16:04:34 +0000 (UTC)"],"DMARC-Filter":"OpenDMARC Filter v1.3.2 mail.kernel.org E825D2394F","Date":"Fri, 18 Aug 2017 11:04:33 -0500","From":"Bjorn Helgaas ","To":"Jon Derrick ","Cc":"linux-pci@vger.kernel.org, iommu@lists.linux-foundation.org,\n\tDavid Woodhouse ,\n\tKeith Busch , Scott Bauer ,\n\tDavid Fugate ,\n\tlinux-kernel@vger.kernel.org, Robin Murphy ","Subject":"Re: [PATCH v2 4/4] iommu: Prevent VMD child devices from being\n\tremapping targets","Message-ID":"<20170818160433.GN28977@bhelgaas-glaptop.roam.corp.google.com>","References":"<20170817181014.1257-1-jonathan.derrick@intel.com>\n\t<20170817181014.1257-5-jonathan.derrick@intel.com>","MIME-Version":"1.0","Content-Type":"text/plain; charset=us-ascii","Content-Disposition":"inline","In-Reply-To":"<20170817181014.1257-5-jonathan.derrick@intel.com>","User-Agent":"Mutt/1.5.21 (2010-09-15)","Sender":"linux-pci-owner@vger.kernel.org","Precedence":"bulk","List-ID":"","X-Mailing-List":"linux-pci@vger.kernel.org"}},{"id":1751318,"web_url":"http://patchwork.ozlabs.org/comment/1751318/","msgid":"<632c5063-97aa-98b8-7951-65d4aed692a7@arm.com>","list_archive_url":null,"date":"2017-08-18T16:35:31","subject":"Re: [PATCH v2 4/4] iommu: Prevent VMD child devices from being\n\tremapping targets","submitter":{"id":65641,"url":"http://patchwork.ozlabs.org/api/people/65641/","name":"Robin Murphy","email":"robin.murphy@arm.com"},"content":"On 18/08/17 17:04, Bjorn Helgaas wrote:\n> [+cc Robin]\n> \n> This series looks fine to me as far as PCI is concerned, and I'd be\n> happy to take it via my tree given an ack from David for this IOMMU\n> piece. Alternatively, you can add my\n> \n> Acked-by: Bjorn Helgaas \n> \n> to the other patches if you want to take it via another tree.\n> \n> Robin raised a question about basically this same patch the first time\n> around. Not sure whether there's still an objection there.\n\nOh, I don't actually mind the patch as-is - implementing proper IOMMU\ngroup support for VMD almost certainly should be the longer-term goal,\nbut for all I know that may be non-trivial so in the meantime a quick\nand simple way to make things safe is good, however heavy-handed.\n\nRobin.\n\n> On Thu, Aug 17, 2017 at 12:10:14PM -0600, Jon Derrick wrote:\n>> VMD child devices must use the VMD endpoint's ID as the requester.\n>> Because of this, there needs to be a way to link the parent VMD\n>> endpoint's iommu group and associated mappings to the VMD child devices\n>> such that attaching and detaching child devices modify the endpoint's\n>> mappings, while preventing early detaching on a singular device removal\n>> or unbinding.\n>>\n>> The reassignment of individual VMD child devices devices to VMs is\n>> outside the scope of VMD, but may be implemented in the future. For now\n>> it is best to prevent any such attempts.\n>>\n>> This patch prevents VMD child devices from returning an IOMMU, which\n>> prevents it from exposing an iommu_group sysfs directories and allowing\n>> subsequent binding by userspace-access drivers such as VFIO.\n>>\n>> Signed-off-by: Jon Derrick \n>> ---\n>> drivers/iommu/intel-iommu.c | 5 +++++\n>> 1 file changed, 5 insertions(+)\n>>\n>> diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c\n>> index 687f18f..94353a6e 100644\n>> --- a/drivers/iommu/intel-iommu.c\n>> +++ b/drivers/iommu/intel-iommu.c\n>> @@ -901,6 +901,11 @@ static struct intel_iommu *device_to_iommu(struct device *dev, u8 *bus, u8 *devf\n>> \t\tstruct pci_dev *pf_pdev;\n>> \n>> \t\tpdev = to_pci_dev(dev);\n>> +\n>> +\t\t/* VMD child devices currently cannot be handled individually */\n>> +\t\tif (is_vmd(pdev->bus))\n>> +\t\t\treturn NULL;\n>> +\n>> \t\t/* VFs aren't listed in scope tables; we need to look up\n>> \t\t * the PF instead to find the IOMMU. */\n>> \t\tpf_pdev = pci_physfn(pdev);\n>> -- \n>> 2.9.4\n>>","headers":{"Return-Path":"","X-Original-To":"incoming@patchwork.ozlabs.org","Delivered-To":"patchwork-incoming@bilbo.ozlabs.org","Authentication-Results":"ozlabs.org;\n\tspf=none (mailfrom) smtp.mailfrom=vger.kernel.org\n\t(client-ip=209.132.180.67; helo=vger.kernel.org;\n\tenvelope-from=linux-pci-owner@vger.kernel.org;\n\treceiver=)","Received":["from vger.kernel.org (vger.kernel.org [209.132.180.67])\n\tby ozlabs.org (Postfix) with ESMTP id 3xYpbs51B3z9t3p\n\tfor ;\n\tSat, 19 Aug 2017 02:35:37 +1000 (AEST)","(majordomo@vger.kernel.org) by vger.kernel.org via listexpand\n\tid S1751108AbdHRQff (ORCPT );\n\tFri, 18 Aug 2017 12:35:35 -0400","from foss.arm.com ([217.140.101.70]:37850 \"EHLO foss.arm.com\"\n\trhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP\n\tid S1750984AbdHRQff (ORCPT );\n\tFri, 18 Aug 2017 12:35:35 -0400","from usa-sjc-imap-foss1.foss.arm.com (unknown [10.72.51.249])\n\tby usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 0C5582B;\n\tFri, 18 Aug 2017 09:35:35 -0700 (PDT)","from [10.1.211.24] (e110467-lin.cambridge.arm.com [10.1.211.24])\n\tby usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPSA id\n\t718573F540; Fri, 18 Aug 2017 09:35:33 -0700 (PDT)"],"Subject":"Re: [PATCH v2 4/4] iommu: Prevent VMD child devices from being\n\tremapping targets","To":"Bjorn Helgaas ,\n\tJon Derrick ","Cc":"linux-pci@vger.kernel.org, iommu@lists.linux-foundation.org,\n\tDavid Woodhouse ,\n\tKeith Busch , Scott Bauer ,\n\tDavid Fugate , linux-kernel@vger.kernel.org","References":"<20170817181014.1257-1-jonathan.derrick@intel.com>\n\t<20170817181014.1257-5-jonathan.derrick@intel.com>\n\t<20170818160433.GN28977@bhelgaas-glaptop.roam.corp.google.com>","From":"Robin Murphy ","Message-ID":"<632c5063-97aa-98b8-7951-65d4aed692a7@arm.com>","Date":"Fri, 18 Aug 2017 17:35:31 +0100","User-Agent":"Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101\n\tThunderbird/52.2.1","MIME-Version":"1.0","In-Reply-To":"<20170818160433.GN28977@bhelgaas-glaptop.roam.corp.google.com>","Content-Type":"text/plain; charset=utf-8","Content-Language":"en-GB","Content-Transfer-Encoding":"7bit","Sender":"linux-pci-owner@vger.kernel.org","Precedence":"bulk","List-ID":"","X-Mailing-List":"linux-pci@vger.kernel.org"}},{"id":1756521,"web_url":"http://patchwork.ozlabs.org/comment/1756521/","msgid":"<20170824160245.GC31858@bhelgaas-glaptop.roam.corp.google.com>","list_archive_url":null,"date":"2017-08-24T16:02:45","subject":"Re: [PATCH v2 4/4] iommu: Prevent VMD child devices from being\n\tremapping targets","submitter":{"id":67298,"url":"http://patchwork.ozlabs.org/api/people/67298/","name":"Bjorn Helgaas","email":"helgaas@kernel.org"},"content":"On Fri, Aug 18, 2017 at 11:04:33AM -0500, Bjorn Helgaas wrote:\n> [+cc Robin]\n> \n> This series looks fine to me as far as PCI is concerned, and I'd be\n> happy to take it via my tree given an ack from David for this IOMMU\n> piece. Alternatively, you can add my\n> \n> Acked-by: Bjorn Helgaas \n> \n> to the other patches if you want to take it via another tree.\n> \n> Robin raised a question about basically this same patch the first time\n> around. Not sure whether there's still an objection there.\n\nPing, David, any thoughts on this patch?\n\n> On Thu, Aug 17, 2017 at 12:10:14PM -0600, Jon Derrick wrote:\n> > VMD child devices must use the VMD endpoint's ID as the requester.\n> > Because of this, there needs to be a way to link the parent VMD\n> > endpoint's iommu group and associated mappings to the VMD child devices\n> > such that attaching and detaching child devices modify the endpoint's\n> > mappings, while preventing early detaching on a singular device removal\n> > or unbinding.\n> > \n> > The reassignment of individual VMD child devices devices to VMs is\n> > outside the scope of VMD, but may be implemented in the future. For now\n> > it is best to prevent any such attempts.\n> > \n> > This patch prevents VMD child devices from returning an IOMMU, which\n> > prevents it from exposing an iommu_group sysfs directories and allowing\n> > subsequent binding by userspace-access drivers such as VFIO.\n> > \n> > Signed-off-by: Jon Derrick \n> > ---\n> > drivers/iommu/intel-iommu.c | 5 +++++\n> > 1 file changed, 5 insertions(+)\n> > \n> > diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c\n> > index 687f18f..94353a6e 100644\n> > --- a/drivers/iommu/intel-iommu.c\n> > +++ b/drivers/iommu/intel-iommu.c\n> > @@ -901,6 +901,11 @@ static struct intel_iommu *device_to_iommu(struct device *dev, u8 *bus, u8 *devf\n> > \t\tstruct pci_dev *pf_pdev;\n> > \n> > \t\tpdev = to_pci_dev(dev);\n> > +\n> > +\t\t/* VMD child devices currently cannot be handled individually */\n> > +\t\tif (is_vmd(pdev->bus))\n> > +\t\t\treturn NULL;\n> > +\n> > \t\t/* VFs aren't listed in scope tables; we need to look up\n> > \t\t * the PF instead to find the IOMMU. */\n> > \t\tpf_pdev = pci_physfn(pdev);\n> > -- \n> > 2.9.4\n> >","headers":{"Return-Path":"","X-Original-To":"incoming@patchwork.ozlabs.org","Delivered-To":"patchwork-incoming@bilbo.ozlabs.org","Authentication-Results":["ozlabs.org;\n\tspf=none (mailfrom) smtp.mailfrom=vger.kernel.org\n\t(client-ip=209.132.180.67; helo=vger.kernel.org;\n\tenvelope-from=linux-pci-owner@vger.kernel.org;\n\treceiver=)","mail.kernel.org;\n\tdmarc=none (p=none dis=none) header.from=kernel.org","mail.kernel.org;\n\tspf=none smtp.mailfrom=helgaas@kernel.org"],"Received":["from vger.kernel.org (vger.kernel.org [209.132.180.67])\n\tby ozlabs.org (Postfix) with ESMTP id 3xdTbH5d59z9sCZ\n\tfor ;\n\tFri, 25 Aug 2017 02:02:51 +1000 (AEST)","(majordomo@vger.kernel.org) by vger.kernel.org via listexpand\n\tid S1753495AbdHXQCt (ORCPT );\n\tThu, 24 Aug 2017 12:02:49 -0400","from mail.kernel.org ([198.145.29.99]:43840 \"EHLO mail.kernel.org\"\n\trhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP\n\tid S1753433AbdHXQCs (ORCPT );\n\tThu, 24 Aug 2017 12:02:48 -0400","from localhost (unknown [69.55.156.165])\n\t(using TLSv1.2 with cipher DHE-RSA-AES128-SHA (128/128 bits))\n\t(No client certificate requested)\n\tby mail.kernel.org (Postfix) with ESMTPSA id 8617521A1B;\n\tThu, 24 Aug 2017 16:02:47 +0000 (UTC)"],"DMARC-Filter":"OpenDMARC Filter v1.3.2 mail.kernel.org 8617521A1B","Date":"Thu, 24 Aug 2017 11:02:45 -0500","From":"Bjorn Helgaas ","To":"Jon Derrick ","Cc":"linux-pci@vger.kernel.org, iommu@lists.linux-foundation.org,\n\tDavid Woodhouse ,\n\tKeith Busch , Scott Bauer ,\n\tDavid Fugate ,\n\tlinux-kernel@vger.kernel.org, Robin Murphy ","Subject":"Re: [PATCH v2 4/4] iommu: Prevent VMD child devices from being\n\tremapping targets","Message-ID":"<20170824160245.GC31858@bhelgaas-glaptop.roam.corp.google.com>","References":"<20170817181014.1257-1-jonathan.derrick@intel.com>\n\t<20170817181014.1257-5-jonathan.derrick@intel.com>\n\t<20170818160433.GN28977@bhelgaas-glaptop.roam.corp.google.com>","MIME-Version":"1.0","Content-Type":"text/plain; charset=us-ascii","Content-Disposition":"inline","In-Reply-To":"<20170818160433.GN28977@bhelgaas-glaptop.roam.corp.google.com>","User-Agent":"Mutt/1.5.21 (2010-09-15)","Sender":"linux-pci-owner@vger.kernel.org","Precedence":"bulk","List-ID":"","X-Mailing-List":"linux-pci@vger.kernel.org"}}]