Re: [PATCH 6/8] iommu/arm-smmu-v3: Support auxiliary domains

[Will Deacon]

Hi Jean-Philippe,

On Mon, Jun 10, 2019 at 07:47:12PM +0100, Jean-Philippe Brucker wrote:
> In commit a3a195929d40 ("iommu: Add APIs for multiple domains per
> device"), the IOMMU API gained the concept of auxiliary domains (AUXD),
> which allows to control the PASID-tagged address spaces of a device. With
> AUXD the PASID address space are not shared with the CPU, but are instead
> modified with iommu_map() and iommu_unmap() calls on auxiliary domains.
> 
> Add auxiliary domain support to the SMMUv3 driver. Device drivers allocate
> an unmanaged IOMMU domain with iommu_domain_alloc(), and attach it to the
> device with iommu_aux_attach_domain().

[...]

> 
> The AUXD API is fairly permissive, and allows to attach an IOMMU domain in
> both normal and auxiliary mode at the same time - one device can be
> attached to the domain normally, and another device can be attached
> through one of its PASIDs. To avoid excessive complexity in the SMMU
> implementation we pose some restrictions on supported AUXD usage:
> 
> * A domain is either in auxiliary mode or normal mode. And that state is
>   sticky. Once detached the domain has to be re-attached in the same mode.
> 
> * An auxiliary domain can have a single parent domain. Two devices can be
>   attached to the same auxiliary domain only if they are attached to the
>   same parent domain.
> 
> In practice these shouldn't be problematic, since we have the same kind of
> restriction on normal domains and users have been able to cope so far: at
> the moment a domain cannot be attached to two devices behind different
> SMMUs. When VFIO puts two such devices in the same container, it simply
> falls back to allocating two separate IOMMU domains.
> 
> Signed-off-by: Jean-Philippe Brucker <jean-philippe.brucker@xxxxxxx>
> ---
>  drivers/iommu/Kconfig       |   1 +
>  drivers/iommu/arm-smmu-v3.c | 276 +++++++++++++++++++++++++++++++++---
>  2 files changed, 260 insertions(+), 17 deletions(-)
> 
> diff --git a/drivers/iommu/Kconfig b/drivers/iommu/Kconfig
> index 9b45f70549a7..d326fef3d3a6 100644
> --- a/drivers/iommu/Kconfig
> +++ b/drivers/iommu/Kconfig
> @@ -393,6 +393,7 @@ config ARM_SMMU_DISABLE_BYPASS_BY_DEFAULT
>  config ARM_SMMU_V3
>  	bool "ARM Ltd. System MMU Version 3 (SMMUv3) Support"
>  	depends on ARM64
> +	select IOASID
>  	select IOMMU_API
>  	select IOMMU_IO_PGTABLE_LPAE
>  	select GENERIC_MSI_IRQ_DOMAIN
> diff --git a/drivers/iommu/arm-smmu-v3.c b/drivers/iommu/arm-smmu-v3.c
> index 326b71793336..633d829f246f 100644
> --- a/drivers/iommu/arm-smmu-v3.c
> +++ b/drivers/iommu/arm-smmu-v3.c
> @@ -19,6 +19,7 @@
>  #include <linux/err.h>
>  #include <linux/interrupt.h>
>  #include <linux/io-pgtable.h>
> +#include <linux/ioasid.h>
>  #include <linux/iommu.h>
>  #include <linux/iopoll.h>
>  #include <linux/init.h>
> @@ -641,6 +642,7 @@ struct arm_smmu_master {
>  	unsigned int			num_sids;
>  	unsigned int			ssid_bits;
>  	bool				ats_enabled		:1;
> +	bool				auxd_enabled		:1;
>  };
>  
>  /* SMMU private data for an IOMMU domain */
> @@ -666,8 +668,14 @@ struct arm_smmu_domain {
>  
>  	struct iommu_domain		domain;
>  
> +	/* Unused in aux domains */
>  	struct list_head		devices;
>  	spinlock_t			devices_lock;
> +
> +	/* Auxiliary domain stuff */
> +	struct arm_smmu_domain		*parent;
> +	ioasid_t			ssid;
> +	unsigned long			aux_nr_devs;

Maybe use a union to avoid comments about what is used/unused?

> +static void arm_smmu_aux_detach_dev(struct iommu_domain *domain, struct device *dev)
> +{
> +	struct iommu_domain *parent_domain;
> +	struct arm_smmu_domain *parent_smmu_domain;
> +	struct arm_smmu_master *master = dev_to_master(dev);
> +	struct arm_smmu_domain *smmu_domain = to_smmu_domain(domain);
> +
> +	if (!arm_smmu_dev_feature_enabled(dev, IOMMU_DEV_FEAT_AUX))
> +		return;
> +
> +	parent_domain = iommu_get_domain_for_dev(dev);
> +	if (!parent_domain)
> +		return;
> +	parent_smmu_domain = to_smmu_domain(parent_domain);
> +
> +	mutex_lock(&smmu_domain->init_mutex);
> +	if (!smmu_domain->aux_nr_devs)
> +		goto out_unlock;
> +
> +	if (!--smmu_domain->aux_nr_devs) {
> +		arm_smmu_write_ctx_desc(parent_smmu_domain, smmu_domain->ssid,
> +					NULL);
> +		/*
> +		 * TLB doesn't need invalidation since accesses from the device
> +		 * can't use this domain's ASID once the CD is clear.
> +		 *
> +		 * Sadly that doesn't apply to ATCs, which are PASID tagged.
> +		 * Invalidate all other devices as well, because even though
> +		 * they weren't 'officially' attached to the auxiliary domain,
> +		 * they could have formed ATC entries.
> +		 */
> +		arm_smmu_atc_inv_domain(smmu_domain, 0, 0);

I've been struggling to understand the locking here, since both
arm_smmu_write_ctx_desc and arm_smmu_atc_inv_domain take and release the
devices_lock for the domain. Is there not a problem with devices coming and
going in-between the two calls?

> +	} else {
> +		struct arm_smmu_cmdq_ent cmd;
> +
> +		/* Invalidate only this device's ATC */
> +		if (master->ats_enabled) {
> +			arm_smmu_atc_inv_to_cmd(smmu_domain->ssid, 0, 0, &cmd);
> +			arm_smmu_atc_inv_master(master, &cmd);
> +		}
> +	}
> +out_unlock:
> +	mutex_unlock(&smmu_domain->init_mutex);
> +}
> +
> +static int arm_smmu_aux_get_pasid(struct iommu_domain *domain, struct device *dev)
> +{
> +	struct arm_smmu_domain *smmu_domain = to_smmu_domain(domain);
> +
> +	return smmu_domain->ssid ?: -EINVAL;
> +}
> +
>  static struct iommu_ops arm_smmu_ops = {
>  	.capable		= arm_smmu_capable,
>  	.domain_alloc		= arm_smmu_domain_alloc,
> @@ -2539,6 +2772,13 @@ static struct iommu_ops arm_smmu_ops = {
>  	.of_xlate		= arm_smmu_of_xlate,
>  	.get_resv_regions	= arm_smmu_get_resv_regions,
>  	.put_resv_regions	= arm_smmu_put_resv_regions,
> +	.dev_has_feat		= arm_smmu_dev_has_feature,
> +	.dev_feat_enabled	= arm_smmu_dev_feature_enabled,
> +	.dev_enable_feat	= arm_smmu_dev_enable_feature,
> +	.dev_disable_feat	= arm_smmu_dev_disable_feature,

Why can't we use the existing ->capable and ->dev_{get,set}_attr callbacks
for this?

Will