VMD fixups

VMD child devices must use the VMD endpoint's ID as the requester. Because of this, there needs to be a way to link the parent VMD endpoint's iommu group and associated mappings to the VMD child devices such that attaching and detaching child devices modify the endpoint's mappings, while preventing early detaching on a singular device removal or unbinding.

The reassignment of individual VMD child devices devices to VMs is outside the scope of VMD, but may be implemented in the future. For now it is best to prevent any such attempts.

This patch prevents VMD child devices from returning an IOMMU, which prevents it from exposing an iommu_group sysfs directories and allowing subsequent binding by userspace-access drivers such as VFIO.

Signed-off-by Jon Derrick <[email protected]>

---
 drivers/iommu/intel-iommu.c | 5 +++++
 1 file changed, 5 insertions(+)

drivers/iommu/intel-iommu.c +5 -0

index 687f18f..94353a6e 100644
@@ -901,6 +901,11 @@ static struct intel_iommu *device_to_iommu(struct device *dev, u8 *bus, u8 *devf
 		struct pci_dev *pf_pdev;
 
 		pdev = to_pci_dev(dev);
+
+		/* VMD child devices currently cannot be handled individually */
+		if (is_vmd(pdev->bus))
+			return NULL;
+
 		/* VFs aren't listed in scope tables; we need to look up
 		 * the PF instead to find the IOMMU. */
 		pf_pdev = pci_physfn(pdev);

Signature · 1 line

2.9.4

[+cc Robin]

This series looks fine to me as far as PCI is concerned, and I'd be happy to take it via my tree given an ack from David for this IOMMU piece. Alternatively, you can add my

Acked-by Bjorn Helgaas <[email protected]>

to the other patches if you want to take it via another tree.

Robin raised a question about basically this same patch the first time around. Not sure whether there's still an objection there.

Quoted 39 lines

VMD child devices must use the VMD endpoint's ID as the requester. Because of this, there needs to be a way to link the parent VMD endpoint's iommu group and associated mappings to the VMD child devices such that attaching and detaching child devices modify the endpoint's mappings, while preventing early detaching on a singular device removal or unbinding.

The reassignment of individual VMD child devices devices to VMs is outside the scope of VMD, but may be implemented in the future. For now it is best to prevent any such attempts.

This patch prevents VMD child devices from returning an IOMMU, which prevents it from exposing an iommu_group sysfs directories and allowing subsequent binding by userspace-access drivers such as VFIO.

Signed-off-by Jon Derrick <[email protected]>

---
 drivers/iommu/intel-iommu.c | 5 +++++
 1 file changed, 5 insertions(+)

drivers/iommu/intel-iommu.c +5 -0

index 687f18f..94353a6e 100644
@@ -901,6 +901,11 @@ static struct intel_iommu *device_to_iommu(struct device *dev, u8 *bus, u8 *devf
 		struct pci_dev *pf_pdev;
 
 		pdev = to_pci_dev(dev);
+
+		/* VMD child devices currently cannot be handled individually */
+		if (is_vmd(pdev->bus))
+			return NULL;
+
 		/* VFs aren't listed in scope tables; we need to look up
 		 * the PF instead to find the IOMMU. */
 		pf_pdev = pci_physfn(pdev);

Signature · 1 line

2.9.4

[+cc Robin]

This series looks fine to me as far as PCI is concerned, and I'd be happy to take it via my tree given an ack from David for this IOMMU piece. Alternatively, you can add my

Acked-by Bjorn Helgaas <[email protected]>

to the other patches if you want to take it via another tree.

Robin raised a question about basically this same patch the first time around. Not sure whether there's still an objection there.

Quoted 39 lines

VMD child devices must use the VMD endpoint's ID as the requester. Because of this, there needs to be a way to link the parent VMD endpoint's iommu group and associated mappings to the VMD child devices such that attaching and detaching child devices modify the endpoint's mappings, while preventing early detaching on a singular device removal or unbinding.

The reassignment of individual VMD child devices devices to VMs is outside the scope of VMD, but may be implemented in the future. For now it is best to prevent any such attempts.

This patch prevents VMD child devices from returning an IOMMU, which prevents it from exposing an iommu_group sysfs directories and allowing subsequent binding by userspace-access drivers such as VFIO.

Signed-off-by Jon Derrick <[email protected]>

---
 drivers/iommu/intel-iommu.c | 5 +++++
 1 file changed, 5 insertions(+)

drivers/iommu/intel-iommu.c +5 -0

index 687f18f..94353a6e 100644
@@ -901,6 +901,11 @@ static struct intel_iommu *device_to_iommu(struct device *dev, u8 *bus, u8 *devf
 		struct pci_dev *pf_pdev;
 
 		pdev = to_pci_dev(dev);
+
+		/* VMD child devices currently cannot be handled individually */
+		if (is_vmd(pdev->bus))
+			return NULL;
+
 		/* VFs aren't listed in scope tables; we need to look up
 		 * the PF instead to find the IOMMU. */
 		pf_pdev = pci_physfn(pdev);

Signature · 1 line

2.9.4

Mostly just cleanup in this revision, eg, trying to limit scope of vmd code to x86

Previous:
https://patchwork.kernel.org/patch/9886095/
https://patchwork.kernel.org/patch/9886097/
https://patchwork.kernel.org/patch/9886101/

Jon Derrick (4):
MAINTAINERS: Add Jonathan Derrick as VMD maintainer pci/x86: Move VMD quirks to x86 fixups
x86/PCI: Use is_vmd rather than relying on the domain number
iommu: Prevent VMD child devices from being remapping targets

 MAINTAINERS                 |  1 +
 arch/x86/pci/fixup.c        | 18 ++++++++++++++++++
 drivers/iommu/intel-iommu.c |  5 +++++
 drivers/pci/quirks.c        | 17 -----------------
 4 files changed, 24 insertions(+), 17 deletions(-)