Re: [PATCH v7 12/23] iommu/smmuv3: Get prepared for nested stage support

[Auger Eric]

Hi Robin,

On 5/13/19 1:43 PM, Robin Murphy wrote:
> On 10/05/2019 15:34, Auger Eric wrote:
>> Hi Robin,
>>
>> On 5/8/19 4:24 PM, Robin Murphy wrote:
>>> On 08/04/2019 13:19, Eric Auger wrote:
>>>> To allow nested stage support, we need to store both
>>>> stage 1 and stage 2 configurations (and remove the former
>>>> union).
>>>>
>>>> A nested setup is characterized by both s1_cfg and s2_cfg
>>>> set.
>>>>
>>>> We introduce a new ste.abort field that will be set upon
>>>> guest stage1 configuration passing. If s1_cfg is NULL and
>>>> ste.abort is set, traffic can't pass. If ste.abort is not set,
>>>> S1 is bypassed.
>>>>
>>>> arm_smmu_write_strtab_ent() is modified to write both stage
>>>> fields in the STE and deal with the abort field.
>>>>
>>>> In nested mode, only stage 2 is "finalized" as the host does
>>>> not own/configure the stage 1 context descriptor, guest does.
>>>>
>>>> Signed-off-by: Eric Auger <eric.auger@xxxxxxxxxx>
>>>>
>>>> ---
>>>>
>>>> v4 -> v5:
>>>> - reset ste.abort on detach
>>>>
>>>> v3 -> v4:
>>>> - s1_cfg.nested_abort and nested_bypass removed.
>>>> - s/ste.nested/ste.abort
>>>> - arm_smmu_write_strtab_ent modifications with introduction
>>>> ÂÂÂ of local abort, bypass and translate local variables
>>>> - comment updated
>>>>
>>>> v1 -> v2:
>>>> - invalidate the STE before moving from a live STE config to another
>>>> - add the nested_abort and nested_bypass fields
>>>> ---
>>>> ÂÂ drivers/iommu/arm-smmu-v3.c | 35 ++++++++++++++++++++---------------
>>>> ÂÂ 1 file changed, 20 insertions(+), 15 deletions(-)
>>>>
>>>> diff --git a/drivers/iommu/arm-smmu-v3.c b/drivers/iommu/arm-smmu-v3.c
>>>> index 21d027695181..e22e944ffc05 100644
>>>> --- a/drivers/iommu/arm-smmu-v3.c
>>>> +++ b/drivers/iommu/arm-smmu-v3.c
>>>> @@ -211,6 +211,7 @@
>>>> ÂÂ #define STRTAB_STE_0_CFG_BYPASSÂÂÂÂÂÂÂ 4
>>>> ÂÂ #define STRTAB_STE_0_CFG_S1_TRANSÂÂÂ 5
>>>> ÂÂ #define STRTAB_STE_0_CFG_S2_TRANSÂÂÂ 6
>>>> +#define STRTAB_STE_0_CFG_NESTEDÂÂÂÂÂÂÂ 7
>>>> ÂÂ Â #define STRTAB_STE_0_S1FMTÂÂÂÂÂÂÂ GENMASK_ULL(5, 4)
>>>> ÂÂ #define STRTAB_STE_0_S1FMT_LINEARÂÂÂ 0
>>>> @@ -514,6 +515,7 @@ struct arm_smmu_strtab_ent {
>>>> ÂÂÂÂÂÂÂ * configured according to the domain type.
>>>> ÂÂÂÂÂÂÂ */
>>>> ÂÂÂÂÂÂ boolÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ assigned;
>>>> +ÂÂÂ boolÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ abort;
>>>> ÂÂÂÂÂÂ struct arm_smmu_s1_cfgÂÂÂÂÂÂÂ *s1_cfg;
>>>> ÂÂÂÂÂÂ struct arm_smmu_s2_cfgÂÂÂÂÂÂÂ *s2_cfg;
>>>> ÂÂ };
>>>> @@ -628,10 +630,8 @@ struct arm_smmu_domain {
>>>> ÂÂÂÂÂÂ boolÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ non_strict;
>>>> ÂÂ ÂÂÂÂÂ enum arm_smmu_domain_stageÂÂÂ stage;
>>>> -ÂÂÂ union {
>>>> -ÂÂÂÂÂÂÂ struct arm_smmu_s1_cfgÂÂÂ s1_cfg;
>>>> -ÂÂÂÂÂÂÂ struct arm_smmu_s2_cfgÂÂÂ s2_cfg;
>>>> -ÂÂÂ };
>>>> +ÂÂÂ struct arm_smmu_s1_cfgÂÂÂ s1_cfg;
>>>> +ÂÂÂ struct arm_smmu_s2_cfgÂÂÂ s2_cfg;
>>>> ÂÂ ÂÂÂÂÂ struct iommu_domainÂÂÂÂÂÂÂ domain;
>>>> ÂÂ @@ -1108,12 +1108,13 @@ static void arm_smmu_write_strtab_ent(struct
>>>> arm_smmu_device *smmu, u32 sid,
>>>> ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ __le64 *dst, struct arm_smmu_strtab_ent *ste)
>>>> ÂÂ {
>>>> ÂÂÂÂÂÂ /*
>>>> -ÂÂÂÂ * This is hideously complicated, but we only really care about
>>>> -ÂÂÂÂ * three cases at the moment:
>>>> +ÂÂÂÂ * We care about the following transitions:
>>>> ÂÂÂÂÂÂÂ *
>>>> ÂÂÂÂÂÂÂ * 1. Invalid (all zero) -> bypass/fault (init)
>>>> -ÂÂÂÂ * 2. Bypass/fault -> translation/bypass (attach)
>>>> -ÂÂÂÂ * 3. Translation/bypass -> bypass/fault (detach)
>>>> +ÂÂÂÂ * 2. Bypass/fault -> single stage translation/bypass (attach)
>>>> +ÂÂÂÂ * 3. single stage Translation/bypass -> bypass/fault (detach)
>>>> +ÂÂÂÂ * 4. S2 -> S1 + S2 (attach_pasid_table)
>>>> +ÂÂÂÂ * 5. S1 + S2 -> S2 (detach_pasid_table)
>>>> ÂÂÂÂÂÂÂ *
>>>> ÂÂÂÂÂÂÂ * Given that we can't update the STE atomically and the SMMU
>>>> ÂÂÂÂÂÂÂ * doesn't read the thing in a defined order, that leaves us
>>>> @@ -1124,7 +1125,7 @@ static void arm_smmu_write_strtab_ent(struct
>>>> arm_smmu_device *smmu, u32 sid,
>>>> ÂÂÂÂÂÂÂ * 3. Update Config, sync
>>>> ÂÂÂÂÂÂÂ */
>>>> ÂÂÂÂÂÂ u64 val = le64_to_cpu(dst[0]);
>>>> -ÂÂÂ bool ste_live = false;
>>>> +ÂÂÂ bool abort, bypass, translate, ste_live = false;
>>>> ÂÂÂÂÂÂ struct arm_smmu_cmdq_ent prefetch_cmd = {
>>>> ÂÂÂÂÂÂÂÂÂÂ .opcodeÂÂÂÂÂÂÂ = CMDQ_OP_PREFETCH_CFG,
>>>> ÂÂÂÂÂÂÂÂÂÂ .prefetchÂÂÂ = {
>>>> @@ -1138,11 +1139,11 @@ static void arm_smmu_write_strtab_ent(struct
>>>> arm_smmu_device *smmu, u32 sid,
>>>> ÂÂÂÂÂÂÂÂÂÂÂÂÂÂ break;
>>>> ÂÂÂÂÂÂÂÂÂÂ case STRTAB_STE_0_CFG_S1_TRANS:
>>>> ÂÂÂÂÂÂÂÂÂÂ case STRTAB_STE_0_CFG_S2_TRANS:
>>>> +ÂÂÂÂÂÂÂ case STRTAB_STE_0_CFG_NESTED:
>>>> ÂÂÂÂÂÂÂÂÂÂÂÂÂÂ ste_live = true;
>>>> ÂÂÂÂÂÂÂÂÂÂÂÂÂÂ break;
>>>> ÂÂÂÂÂÂÂÂÂÂ case STRTAB_STE_0_CFG_ABORT:
>>>> -ÂÂÂÂÂÂÂÂÂÂÂ if (disable_bypass)
>>>> -ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ break;
>>>> +ÂÂÂÂÂÂÂÂÂÂÂ break;
>>>> ÂÂÂÂÂÂÂÂÂÂ default:
>>>> ÂÂÂÂÂÂÂÂÂÂÂÂÂÂ BUG(); /* STE corruption */
>>>> ÂÂÂÂÂÂÂÂÂÂ }
>>>> @@ -1152,8 +1153,13 @@ static void arm_smmu_write_strtab_ent(struct
>>>> arm_smmu_device *smmu, u32 sid,
>>>> ÂÂÂÂÂÂ val = STRTAB_STE_0_V;
>>>> ÂÂ ÂÂÂÂÂ /* Bypass/fault */
>>>> -ÂÂÂ if (!ste->assigned || !(ste->s1_cfg || ste->s2_cfg)) {
>>>> -ÂÂÂÂÂÂÂ if (!ste->assigned && disable_bypass)
>>>> +
>>>> +ÂÂÂ abort = (!ste->assigned && disable_bypass) || ste->abort;
>>>> +ÂÂÂ translate = ste->s1_cfg || ste->s2_cfg;
>>>> +ÂÂÂ bypass = !abort && !translate;
>>>> +
>>>> +ÂÂÂ if (abort || bypass) {
>>>> +ÂÂÂÂÂÂÂ if (abort)
>>>> ÂÂÂÂÂÂÂÂÂÂÂÂÂÂ val |= FIELD_PREP(STRTAB_STE_0_CFG,
>>>> STRTAB_STE_0_CFG_ABORT);
>>>> ÂÂÂÂÂÂÂÂÂÂ else
>>>> ÂÂÂÂÂÂÂÂÂÂÂÂÂÂ val |= FIELD_PREP(STRTAB_STE_0_CFG,
>>>> STRTAB_STE_0_CFG_BYPASS);
>>>> @@ -1172,7 +1178,6 @@ static void arm_smmu_write_strtab_ent(struct
>>>> arm_smmu_device *smmu, u32 sid,
>>>> ÂÂÂÂÂÂ }
>>>> ÂÂ ÂÂÂÂÂ if (ste->s1_cfg) {
>>>> -ÂÂÂÂÂÂÂ BUG_ON(ste_live);
>>>
>>> Hmm, I'm a little uneasy about just removing these checks altogether, as
>>> there are still cases where rewriting a live entry is bogus, that we'd
>>> really like to keep catching. Is the problem that it's hard to tell when
>>> you're 'rewriting' the S2 config of a nested entry with the same thing
>>> on attaching/detaching its S1 context?
>> No, I restored the original checks in !nested mode and added a new check
>> to make sure we never update a live S1 in nested mode. Only S2 can be
>> live.
> 
> Right, either way it's fairly easy to enforce "!(cfg->s1 && ste->s1)",
> but what I'm really concerned about is that fact where Stream IDs (or
> possibly PASIDS) get messed up and we end up silently writing a nested
> config over an STE which happens to already have an S2 configuration for
> some other domain (or vice versa).

> 
> I guess it might suffice to verify that the VTTBRs match for S2<->nested
> transitions, what do you reckon?
Yes I can test the STE.S2TTB values which should are identical during
such transitions.

Thanks

Eric
> 
> Robin.