Re: [PATCH v7 23/24] iommu/arm-smmu-v3-kvm: Enable nesting

[Jason Gunthorpe]

> [ ... 129 lines skipped ... ]
> +	ret = smmu_attach_stage_2(&target);
> +	if (ret)
> +		return ret;
> +	hyp_spin_lock(&smmu->hw_lock);
> +	cur_valid = FIELD_GET(STRTAB_STE_0_V, le64_to_cpu(hyp_ste_ptr->data[0]));
> +	target_cfg = FIELD_GET(STRTAB_STE_0_CFG, le64_to_cpu(target.data[0]));
> +	target_valid = FIELD_GET(STRTAB_STE_0_V, le64_to_cpu(target.data[0]));
> +	if ((cur_valid && !target_valid) ||
> +	    (target_cfg == STRTAB_STE_0_CFG_ABORT)) {
> +		WRITE_ONCE(hyp_ste_ptr->data[0], target.data[0]);
> +		WARN_ON(smmu_send_cmd(smmu, &cfgi_cmd));
> +		for (i = 1; i < STRTAB_STE_DWORDS; i++)
> +			WRITE_ONCE(hyp_ste_ptr->data[i], target.data[i]);
> +	} else {
> +		for (i = 1; i < STRTAB_STE_DWORDS; i++)
> +			WRITE_ONCE(hyp_ste_ptr->data[i], target.data[i]);
> +		WARN_ON(smmu_send_cmd(smmu, &cfgi_cmd));
> +		WRITE_ONCE(hyp_ste_ptr->data[0], target.data[0]);
> +	}

This doesn't look good enough, a driver can't safe writely to a valid
STE in any order like this, and it can't make it non-valid or risk
breaking guests. We had this bug in linux already, the hitless STE
update in the hypervisor is mandatory for linux guests using PASID.

You should use the STE programmer logic from the main driver which
gets this right for every scenario a linux guest can trigger. I don't
think there is anything about it that would be difficult for pkvm.

-- 
Jason