lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date:   Fri, 12 Apr 2019 12:13:24 +0800
From:   Lu Baolu <>
To:     Joerg Roedel <>,
        David Woodhouse <>,
        Alex Williamson <>,
        Kirti Wankhede <>
        Jean-Philippe Brucker <>,,,,,,,,, Lu Baolu <>,
        Jacob Pan <>
Subject: [PATCH v9 1/3] vfio/mdev: Add iommu related member in mdev_device

A parent device might create different types of mediated
devices. For example, a mediated device could be created
by the parent device with full isolation and protection
provided by the IOMMU. One usage case could be found on
Intel platforms where a mediated device is an assignable
subset of a PCI, the DMA requests on behalf of it are all
tagged with a PASID. Since IOMMU supports PASID-granular
translations (scalable mode in VT-d 3.0), this mediated
device could be individually protected and isolated by an

This patch adds a new member in the struct mdev_device to
indicate that the mediated device represented by mdev could
be isolated and protected by attaching a domain to a device
represented by mdev->iommu_device. It also adds a helper to
add or set the iommu device.

* mdev_device->iommu_device
  - This, if set, indicates that the mediated device could
    be fully isolated and protected by IOMMU via attaching
    an iommu domain to this device. If empty, it indicates
    using vendor defined isolation, hence bypass IOMMU.

* mdev_set/get_iommu_device(dev, iommu_device)
  - Set or get the iommu device which represents this mdev
    in IOMMU's device scope. Drivers don't need to set the
    iommu device if it uses vendor defined isolation.

Cc: Ashok Raj <>
Cc: Jacob Pan <>
Cc: Kevin Tian <>
Cc: Liu Yi L <>
Suggested-by: Kevin Tian <>
Suggested-by: Alex Williamson <>
Signed-off-by: Lu Baolu <>
Reviewed-by: Jean-Philippe Brucker <>
Reviewed-by: Kirti Wankhede <>
Acked-by: Alex Williamson <>
 drivers/vfio/mdev/mdev_core.c    | 18 ++++++++++++++++++
 drivers/vfio/mdev/mdev_private.h |  1 +
 include/linux/mdev.h             | 14 ++++++++++++++
 3 files changed, 33 insertions(+)

diff --git a/drivers/vfio/mdev/mdev_core.c b/drivers/vfio/mdev/mdev_core.c
index 9d29c71bcf99..318959a994e4 100644
--- a/drivers/vfio/mdev/mdev_core.c
+++ b/drivers/vfio/mdev/mdev_core.c
@@ -396,6 +396,24 @@ int mdev_device_remove(struct device *dev, bool force_remove)
 	return 0;
+int mdev_set_iommu_device(struct device *dev, struct device *iommu_device)
+	struct mdev_device *mdev = to_mdev_device(dev);
+	mdev->iommu_device = iommu_device;
+	return 0;
+struct device *mdev_get_iommu_device(struct device *dev)
+	struct mdev_device *mdev = to_mdev_device(dev);
+	return mdev->iommu_device;
 static int __init mdev_init(void)
 	return mdev_bus_register();
diff --git a/drivers/vfio/mdev/mdev_private.h b/drivers/vfio/mdev/mdev_private.h
index 379758c52b1b..f4eba723fea5 100644
--- a/drivers/vfio/mdev/mdev_private.h
+++ b/drivers/vfio/mdev/mdev_private.h
@@ -33,6 +33,7 @@ struct mdev_device {
 	struct kref ref;
 	struct list_head next;
 	struct kobject *type_kobj;
+	struct device *iommu_device;
 	bool active;
diff --git a/include/linux/mdev.h b/include/linux/mdev.h
index 12354ab4164a..f4a88a6dd054 100644
--- a/include/linux/mdev.h
+++ b/include/linux/mdev.h
@@ -15,6 +15,20 @@
 struct mdev_device;
+ * Called by the parent device driver to set the device which represents
+ * this mdev in iommu protection scope. By default, the iommu device is
+ * NULL, that indicates using vendor defined isolation.
+ *
+ * @dev: the mediated device that iommu will isolate.
+ * @iommu_device: a pci device which represents the iommu for @dev.
+ *
+ * Return 0 for success, otherwise negative error value.
+ */
+int mdev_set_iommu_device(struct device *dev, struct device *iommu_device);
+struct device *mdev_get_iommu_device(struct device *dev);
  * struct mdev_parent_ops - Structure to be registered for each parent device to
  * register the device to mdev module.

Powered by blists - more mailing lists