linux-kernel - Re: [RFC PATCH 0/4] iommu: Per-group default domain type

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 21 Jan 2020 10:14:07 +0000
From:   John Garry <john.garry@...wei.com>
To:     Lu Baolu <baolu.lu@...ux.intel.com>,
        Joerg Roedel <joro@...tes.org>,
        "Greg Kroah-Hartman" <gregkh@...uxfoundation.org>,
        Bjorn Helgaas <bhelgaas@...gle.com>
CC:     <kevin.tian@...el.com>, <ashok.raj@...el.com>,
        <linux-kernel@...r.kernel.org>, <iommu@...ts.linux-foundation.org>,
        <jacob.jun.pan@...el.com>, Robin Murphy <robin.murphy@....com>,
        "Christoph Hellwig" <hch@....de>,
        Sai Praneeth Prakhya <sai.praneeth.prakhya@...el.com>
Subject: Re: [RFC PATCH 0/4] iommu: Per-group default domain type

On 21/01/2020 00:43, Lu Baolu wrote:
>>> An IOMMU group represents the smallest set of devices that are 
>>> considered
>>> to be isolated. All devices belonging to an IOMMU group share a default
>>> domain for DMA APIs. There are two types of default domain: 
>>> IOMMU_DOMAIN_DMA
>>> and IOMMU_DOMAIN_IDENTITY. The former means IOMMU translation, while the
>>> latter means IOMMU by-pass.
>>>
>>> Currently, the default domain type for the IOMMU groups is determined
>>> globally. All IOMMU groups use a single default domain type. The global
>>> default domain type can be adjusted by kernel build configuration or
>>> kernel parameters.
>>>
>>> More and more users are looking forward to a fine grained default domain
>>> type. For example, with the global default domain type set to 
>>> translation,
>>> the OEM verndors or end users might want some trusted and fast-speed 
>>> devices
>>> to bypass IOMMU for performance gains. On the other hand, with global
>>> default domain type set to by-pass, some devices with limited system
>>> memory addressing capability might want IOMMU translation to remove the
>>> bounce buffer overhead.
>>
>> Hi Lu Baolu,
>>
>> Do you think that it would be a more common usecase to want 
>> kernel-managed devices to be passthrough for performance reasons and 
>> some select devices to be in DMA domain, like those with limited 
>> address cap or whose drivers request huge amounts of memory?
>>
>> I just think it would be more manageable to set kernel commandline 
>> parameters for this, i.e. those select few which want DMA domain.
>>

Hi Baolu,

> 
> It's just two sides of a coin. Currently, iommu subsystem make DMA
> domain by default, that's the reason why I selected to let user set
> which devices are willing to use identity domains.
> 

OK, understood.

There was an alternate solution here which would allow per-group type to 
be updated via sysfs:

https://lore.kernel.org/linux-iommu/cover.1566353521.git.sai.praneeth.prakhya@intel.com/

Any idea what happened to that?

Cheers,
John