linux-kernel - Re: [PATCH v3 1/5] iommu: Add static iommu_ops->release

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Thu, 11 Apr 2024 10:41:54 -0300
From: Jason Gunthorpe <jgg@...pe.ca>
To: Robin Murphy <robin.murphy@....com>
Cc: Lu Baolu <baolu.lu@...ux.intel.com>, Joerg Roedel <joro@...tes.org>,
	Will Deacon <will@...nel.org>, Kevin Tian <kevin.tian@...el.com>,
	Eric Badger <ebadger@...estorage.com>, iommu@...ts.linux.dev,
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH v3 1/5] iommu: Add static iommu_ops->release_domain

On Wed, Apr 10, 2024 at 05:37:06PM +0100, Robin Murphy wrote:
> > We should probably be sensitive to the
> > dev->iommu->require_direct flag - generally drivers should prefer the
> > blocked for the release domain, but in case the FW ias asking for
> > require_direct we need to switch to identity.
> 
> At this point do we even need release_domain?

Ultimately ideally not, but I feel better going through the exercise
driver-by-driver before we just make the core code do it
automatically. Maybe I'm being overly pessimistic about the drivers..

Have all the drivers setting identity/blocked domain set release
domain before we switch to this unconditional method.

Anyhow, I just noticed it went into -rc1 already, so may as well keep
going.

> static void iommu_set_release_domain(struct device *dev)
> {
> 	const struct iommu_ops *ops = dev_iommu_ops(dev);
> 	struct iommu_domain *rd;
> 
> 	/*
> 	 * Static domains are expected not to track any device state,
> 	 * and thus be tolerant of devices disappearing once "attached"
> 	 */
> 	if (ops->blocked_domain && !(dev->iommu->require_direct ||
> other_arch_or_platform_reason))
> 		rd = ops->blocked_domain;
> 	else if (ops->identity_domain)
> 		rd = ops->identity_domain;
> 	else /* Hope release_device does the right thing! */
> 		return;
> 
> 	if (!dev->iommu->attach_deferred && rd != dev->iommu_group->domain)
> 		__iommu_attach_device(rd, dev);
> }

Yeah, this is a good end goal.

Jason