Re: [RFC PATCH v6 05/11] iommu: Add a helper to validate a vIOMMU parent

[Aneesh Kumar K . V]

Jason Gunthorpe <jgg@xxxxxxxxxx> writes:

>> [ ... 18 lines skipped ... ]
>> +int iommu_viommu_validate_parent(struct device *dev,
>> +		enum iommu_viommu_type type, struct iommu_domain *parent_domain)
>> +{
>
> I didn't see anything that calls this? I can't imagine what it would
> be needed for?
>


That call is part of the TSM backend driver. The full backend driver is available here:

https://git.gitlab.arm.com/linux-arm/linux-cca/-/commits/cca/scratch/vdevice-tdi?ref_type=heads

int cca_viommu_init(struct iommufd_viommu *viommu, struct device *dev,
		    struct iommu_domain *parent,
		    const struct iommu_user_data *user_data)
{
	struct arm_smmu_realm_params params;
	struct cca_viommu *cca = to_cca_viommu(viommu);
	struct cca_psmmu *psmmu;
	struct kvm *kvm;
	int ret;

	(void)user_data;

	if (viommu->type != IOMMU_VIOMMU_TYPE_ARM_REALM_SMMUV3)
		return -EOPNOTSUPP;
	if (!viommu->kvm_file)
		return -EINVAL;
	kvm = viommu->kvm_file->private_data;
	ret = kvm_realm_ensure_created(kvm);
	if (ret)
		return ret;

	ret = iommu_viommu_validate_parent(dev, viommu->type, parent);
	if (ret)
		return ret;
	ret = iommu_viommu_get_params(dev, viommu->type, &params,
				      sizeof(params));
	if (ret)
		return ret;

	psmmu = cca_psmmu_get(&params);
	if (IS_ERR(psmmu))
		return PTR_ERR(psmmu);
	cca->psmmu = psmmu;
	viommu->ops = &cca_viommu_ops;
	return 0;
}


>
> The TSM viommu should use a NULL parent domain, it doesn't have an
> iommufd managed S2.
>

How would we assign an untrusted device? I currently follow these steps:

1. Create an HWPT with IOMMU_HWPT_ALLOC_NEST_PARENT.
2. Allocate a vIOMMU with viommu.hwpt_id set to that hwpt_id.
3. Allocate a vdevice with alloc_vdev.viommu_id set to that viommu_id.
4. Use VFIO_DEVICE_ATTACH_IOMMUFD_PT with the hwpt_id.

I use the same iommufd for both trusted and untrusted devices because
the guest controls that transition. While operating in untrusted mode, I
use the iommufd to insert DMA mappings via IOMMU_IOAS_MAP.


-aneesh