| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20250923172229.GD2608121@nvidia.com>
Date: Tue, 23 Sep 2025 14:22:29 -0300
From: Jason Gunthorpe <jgg@...dia.com>
To: Nicolin Chen <nicolinc@...dia.com>
Cc: "Tian, Kevin" <kevin.tian@...el.com>,
"joro@...tes.org" <joro@...tes.org>,
"bhelgaas@...gle.com" <bhelgaas@...gle.com>,
"suravee.suthikulpanit@....com" <suravee.suthikulpanit@....com>,
"will@...nel.org" <will@...nel.org>,
"robin.murphy@....com" <robin.murphy@....com>,
"sven@...nel.org" <sven@...nel.org>, "j@...nau.net" <j@...nau.net>,
"alyssa@...enzweig.io" <alyssa@...enzweig.io>,
"neal@...pa.dev" <neal@...pa.dev>,
"robin.clark@....qualcomm.com" <robin.clark@....qualcomm.com>,
"m.szyprowski@...sung.com" <m.szyprowski@...sung.com>,
"krzk@...nel.org" <krzk@...nel.org>,
"alim.akhtar@...sung.com" <alim.akhtar@...sung.com>,
"dwmw2@...radead.org" <dwmw2@...radead.org>,
"baolu.lu@...ux.intel.com" <baolu.lu@...ux.intel.com>,
"yong.wu@...iatek.com" <yong.wu@...iatek.com>,
"matthias.bgg@...il.com" <matthias.bgg@...il.com>,
"angelogioacchino.delregno@...labora.com" <angelogioacchino.delregno@...labora.com>,
"tjeznach@...osinc.com" <tjeznach@...osinc.com>,
"paul.walmsley@...ive.com" <paul.walmsley@...ive.com>,
"palmer@...belt.com" <palmer@...belt.com>,
"aou@...s.berkeley.edu" <aou@...s.berkeley.edu>,
"alex@...ti.fr" <alex@...ti.fr>,
"heiko@...ech.de" <heiko@...ech.de>,
"schnelle@...ux.ibm.com" <schnelle@...ux.ibm.com>,
"mjrosato@...ux.ibm.com" <mjrosato@...ux.ibm.com>,
"gerald.schaefer@...ux.ibm.com" <gerald.schaefer@...ux.ibm.com>,
"orsonzhai@...il.com" <orsonzhai@...il.com>,
"baolin.wang@...ux.alibaba.com" <baolin.wang@...ux.alibaba.com>,
"zhang.lyra@...il.com" <zhang.lyra@...il.com>,
"wens@...e.org" <wens@...e.org>,
"jernej.skrabec@...il.com" <jernej.skrabec@...il.com>,
"samuel@...lland.org" <samuel@...lland.org>,
"jean-philippe@...aro.org" <jean-philippe@...aro.org>,
"rafael@...nel.org" <rafael@...nel.org>,
"lenb@...nel.org" <lenb@...nel.org>,
"Liu, Yi L" <yi.l.liu@...el.com>,
"cwabbott0@...il.com" <cwabbott0@...il.com>,
"quic_pbrahma@...cinc.com" <quic_pbrahma@...cinc.com>,
"iommu@...ts.linux.dev" <iommu@...ts.linux.dev>,
"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
"asahi@...ts.linux.dev" <asahi@...ts.linux.dev>,
"linux-arm-kernel@...ts.infradead.org" <linux-arm-kernel@...ts.infradead.org>,
"linux-arm-msm@...r.kernel.org" <linux-arm-msm@...r.kernel.org>,
"linux-samsung-soc@...r.kernel.org" <linux-samsung-soc@...r.kernel.org>,
"linux-mediatek@...ts.infradead.org" <linux-mediatek@...ts.infradead.org>,
"linux-riscv@...ts.infradead.org" <linux-riscv@...ts.infradead.org>,
"linux-rockchip@...ts.infradead.org" <linux-rockchip@...ts.infradead.org>,
"linux-s390@...r.kernel.org" <linux-s390@...r.kernel.org>,
"linux-sunxi@...ts.linux.dev" <linux-sunxi@...ts.linux.dev>,
"linux-tegra@...r.kernel.org" <linux-tegra@...r.kernel.org>,
"virtualization@...ts.linux.dev" <virtualization@...ts.linux.dev>,
"linux-acpi@...r.kernel.org" <linux-acpi@...r.kernel.org>,
"linux-pci@...r.kernel.org" <linux-pci@...r.kernel.org>,
"patches@...ts.linux.dev" <patches@...ts.linux.dev>,
"Sethi, Vikram" <vsethi@...dia.com>,
"helgaas@...nel.org" <helgaas@...nel.org>,
"etzhao1900@...il.com" <etzhao1900@...il.com>
Subject: Re: [PATCH v4 1/7] iommu/arm-smmu-v3: Add release_domain to attach
prior to release_dev()
On Fri, Sep 19, 2025 at 03:47:49PM -0700, Nicolin Chen wrote:
> +/* Same as arm_smmu_blocked_ops but less set_dev_pasid */
> +static const struct iommu_domain_ops arm_smmu_release_ops = {
> + .attach_dev = arm_smmu_attach_dev_blocked,
> +};
don't worry about set_dev_pasid for the release domain, it is never
called anyhow.
The intention is to just use identity or blocked domains as is.
Jason
> -----------------------------------------------------------------
> From: Jason Gunthorpe <jgg@...dia.com>
> Date: Fri, 19 Sep 2025 22:26:45 +0000
> Subject: [PATCH] iommu: Use identity_domain as release_domain for
> require_direct
>
> If dev->iommu->require_direct is set, the core prevent attaching a BLOCKED
> domains entirely in __iommu_device_set_domain():
>
> if (dev->iommu->require_direct &&
> (new_domain->type == IOMMU_DOMAIN_BLOCKED ||
> new_domain == group->blocking_domain)) {
> dev_warn(dev, "....");
> return -EINVAL;
> }
>
> Thus, in most sane cases, the above will never convert BLOCKED to IDENTITY
> in order to preserve the RMRs (direct mappings).
>
> A similar situation would happen to the release_domain: while driver might
> have set it to a BLOCKED domain, replace it with an IDENTITY for RMRs.
How about
[PATCH] iommu: Generic support for RMRs during device release
Generally an IOMMU driver should leave the translation as BLOCKED
until the translation entry is probed onto a struct device. When the
struct device is removed the translation should be put back to
BLOCKED.
Drivers that are able to work like this can set their release_domain
to their blocking domain and the core code handles this work.
The exception is if the device has a IOMMU_RESV_DIRECT region. In this
case the OS should continuously allow translation for the given
range. The core code generally prevents using a BLOCKED domain with
this device.
Continue this logic for the device release and hoist some open coding
from drivers. If the device has dev->iommu->require_direct and the
driver is using a BLOCKED release_domain override this to IDENTITY to
preserve the semantics.
The only remaining required driver code for IOMMU_RESV_DIRECT should
preset an IDENTITY translation during early IOMMU startup for those
devices.
Jason
Powered by blists - more mailing lists