Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates
 216.228.112.34 as permitted sender) receiver=protection.outlook.com;
 client-ip=216.228.112.34; helo=mail.nvidia.com;
Subject: Re: [PATCH V4 05/18] iommu/ioasid: Redefine IOASID set and allocation
 APIs
To:     David Gibson <david@gibson.dropbear.id.au>
CC:     Jason Gunthorpe <jgg@nvidia.com>,
        Alex Williamson <alex.williamson@redhat.com>,
        "Liu, Yi L" <yi.l.liu@intel.com>,
        Jacob Pan <jacob.jun.pan@linux.intel.com>,
        Auger Eric <eric.auger@redhat.com>,
        Jean-Philippe Brucker <jean-philippe@linaro.org>,
        "Tian, Kevin" <kevin.tian@intel.com>,
        LKML <linux-kernel@vger.kernel.org>,
        Joerg Roedel <joro@8bytes.org>,
        Lu Baolu <baolu.lu@linux.intel.com>,
        David Woodhouse <dwmw2@infradead.org>,
        "iommu@lists.linux-foundation.org" <iommu@lists.linux-foundation.org>,
        "cgroups@vger.kernel.org" <cgroups@vger.kernel.org>,
        Tejun Heo <tj@kernel.org>, Li Zefan <lizefan@huawei.com>,
        Johannes Weiner <hannes@cmpxchg.org>,
        "Jean-Philippe Brucker" <jean-philippe@linaro.com>,
        Jonathan Corbet <corbet@lwn.net>,
        "Raj, Ashok" <ashok.raj@intel.com>, "Wu, Hao" <hao.wu@intel.com>,
        "Jiang, Dave" <dave.jiang@intel.com>,
        Alexey Kardashevskiy <aik@ozlabs.ru>, Neo Jia <cjia@nvidia.com>
References: <20210428145622.GU1370958@nvidia.com> <YIoiJRY3FM7xH2bH@yekko>
 <20210503161518.GM1370958@nvidia.com> <YJy9o8uEZs42/qDM@yekko>
 <20210513135938.GG1002214@nvidia.com> <YKtbWo7PwIlXjFIV@yekko>
 <20210524233744.GT1002214@nvidia.com>
 <ce2fcf21-1803-047b-03f0-7a4108dea7af@nvidia.com>
 <20210525195257.GG1002214@nvidia.com>
 <6b13399d-cf03-1e71-3624-c39d4d05e958@nvidia.com> <YK8nXKAJdfT5UVEu@yekko>
From:   Kirti Wankhede <kwankhede@nvidia.com>
Message-ID: <2476b70c-9320-a49c-efa5-fb7027e1b572@nvidia.com>
Date:   Thu, 27 May 2021 23:55:00 +0530
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:78.0) Gecko/20100101
 Thunderbird/78.9.1
MIME-Version: 1.0
In-Reply-To: <YK8nXKAJdfT5UVEu@yekko>
Content-Type: text/plain; charset="windows-1252"; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 7bit
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 27 May 2021 18:25:13.3845
 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 99a934c6-bc0b-458f-fc6b-08d9213cc4f3
X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.112.34];Helo=[mail.nvidia.com]
X-MS-Exchange-CrossTenant-AuthSource: BN8NAM11FT017.eop-nam11.prod.protection.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR12MB3292
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org


On 5/27/2021 10:30 AM, David Gibson wrote:
> On Wed, May 26, 2021 at 02:48:03AM +0530, Kirti Wankhede wrote:
>>
>>
>> On 5/26/2021 1:22 AM, Jason Gunthorpe wrote:
>>> On Wed, May 26, 2021 at 12:56:30AM +0530, Kirti Wankhede wrote:
>>>
>>>> 2. iommu backed mdev devices for SRIOV where mdev device is created per
>>>> VF (mdev device == VF device) then that mdev device has same iommu
>>>> protection scope as VF associated to it.
>>>
>>> This doesn't require, and certainly shouldn't create, a fake group.
>>>
>>> Only the VF's real IOMMU group should be used to model an iommu domain
>>> linked to a VF. Injecting fake groups that are proxies for real groups
>>> only opens the possibility of security problems like David is
>>> concerned with.
>>>
>>
>> I think this security issue should be addressed by letting mdev device
>> inherit its parent's iommu_group, i.e. VF's iommu_group here.
> 
> No, that doesn't work.  AIUI part of the whole point of mdevs is to
> allow chunks of a single PCI function to be handed out to different
> places, because they're isolated from each other not by the system
> IOMMU, but by a combination of MMU hardware in the hardware (e.g. in a
> GPU card) and software in the mdev driver. 

That's correct for non-iommu backed mdev devices.

> If mdevs inherited the
> group of their parent device they wouldn't count as isolated from each
> other, which they should.
> 

For iommu backed mdev devices for SRIOV, where there can be single mdev 
device for its parent, here parent device is VF, there can't be multiple 
mdev devices associated with that VF. In this case mdev can inherit the 
group of parent device.

Kirti