Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Date:   Tue, 21 Sep 2021 13:40:01 -0300
From:   Jason Gunthorpe <jgg@nvidia.com>
To:     Liu Yi L <yi.l.liu@intel.com>
Cc:     alex.williamson@redhat.com, hch@lst.de, jasowang@redhat.com,
        joro@8bytes.org, jean-philippe@linaro.org, kevin.tian@intel.com,
        parav@mellanox.com, lkml@metux.net, pbonzini@redhat.com,
        lushenming@huawei.com, eric.auger@redhat.com, corbet@lwn.net,
        ashok.raj@intel.com, yi.l.liu@linux.intel.com,
        jun.j.tian@intel.com, hao.wu@intel.com, dave.jiang@intel.com,
        jacob.jun.pan@linux.intel.com, kwankhede@nvidia.com,
        robin.murphy@arm.com, kvm@vger.kernel.org,
        iommu@lists.linux-foundation.org, dwmw2@infradead.org,
        linux-kernel@vger.kernel.org, baolu.lu@linux.intel.com,
        david@gibson.dropbear.id.au, nicolinc@nvidia.com
Subject: Re: [RFC 05/20] vfio/pci: Register device to /dev/vfio/devices
Message-ID: <20210921164001.GR327412@nvidia.com>
References: <20210919063848.1476776-1-yi.l.liu@intel.com>
 <20210919063848.1476776-6-yi.l.liu@intel.com>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20210919063848.1476776-6-yi.l.liu@intel.com>
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?6tNABDb+PaM6g8iXepja8zX5/0yRgg0q15eF2otMrvsChbcq/7sE9TgpeSZ2?=
 =?us-ascii?Q?g9h/hiS/IMoocOZEFHMHJiKoniqFZK+4IDwyKBCljZ8UwSCFakQzxdcglhxC?=
 =?us-ascii?Q?FbImIlvDF217PaMenAbQTKT+IQcpndmPAjv7Vs6kanu466/ivpCQ8tRjoLVz?=
 =?us-ascii?Q?2ucfJ1+AVnJ4nR3g0/V1BbjncCyKZR2MFD5parbHwv+2a118ImiLxRX5tzob?=
 =?us-ascii?Q?c2Ed8MJqUEIHHCGQNvFRv7f73NFgHNierVhnIkZffkOspOkSpXbhaEXtMwYU?=
 =?us-ascii?Q?AHJqdA96DpKL5oSCTIvbyjuKioa3yt8vR68cw3BDzAEAUNT4pY8CyFDeOxxQ?=
 =?us-ascii?Q?2jO3sJ/PyMzby/vrHtHv+4YFuGRw5L5engSHb+C8aZyWGvXXr8fQ+YShzB4O?=
 =?us-ascii?Q?ka0+jx7gcS7uTxZiqbUi66v8scU8wFqQVq0quVzEgmnlNdyp8o3eiFgns16x?=
 =?us-ascii?Q?WCS2ceH5Rt4Qvs3h3K/VCXdLQ1kVUyvbbHvpkx0kBByNX2slESLnpCa3oBpr?=
 =?us-ascii?Q?eurkHessrz7mrQh7gyu5nIE+DlpyrW29JbLrEwecXqlJ59GULZZ8nDaoPRz9?=
 =?us-ascii?Q?cvdd29Jt9oD6i7G/UDLvvyONiu7viDAZxFNIh1qs9OE1FLCP2vmkOx/vhevZ?=
 =?us-ascii?Q?aB8jf5iesJ43+bFXViDzZGqRkqo4dwjibPZOH6TLyDfOSmpHE5OoE4Mu2nPF?=
 =?us-ascii?Q?OIzktvY5+jXVkONlSNAYuTpWyMhFw1kJ7WDoRotm/3wxTjqtQ8Za0W8UFq6h?=
 =?us-ascii?Q?92N7Mqdg6J2tLqzn1rCNcmWDqMXoGU+AF+nyi8/OEbnCCXHql/9YN3IXGzcP?=
 =?us-ascii?Q?s7Humq27DKRGG0Dp/MpbVX+Rt99q7Y2EPABsZD8S5chZxmuB6BcVITk0BBqj?=
 =?us-ascii?Q?/eAUpMHPr/reSusZBFe+aBP1ygIjv5fWscwToyoLAGmYQKkGstJ3FuPyOkJ9?=
 =?us-ascii?Q?Txfk1+Iqfq1jS3lvoB0NihD2g1fgvCvobZkDodHyUV+Ujax2Q/BEPeg0eI5w?=
 =?us-ascii?Q?/8Kr1QXoQgCpTG/PU/9sF7zYySZsN5DXqKFR+eocrzQWHaz+UUy1Jqwt2DJ6?=
 =?us-ascii?Q?Zcg2UD3C0bFHUub6UxnC4WYYvTgXFV3HqqCjB8Cj6kC8ZRo7xMwpFgOz/cro?=
 =?us-ascii?Q?nQJL6r+3k5x9Fi4opH/W9NT/4ZA+qPZAf9tY9aHQOnB8NPg1e7Y+eYf4WFqy?=
 =?us-ascii?Q?+mM2FuvasM9hchwvqAESnmDPK3PxIr4pQ6uVBKJcMycBxbWKScz8qRaTQF26?=
 =?us-ascii?Q?zNJzZoWGFi5FjUfAkISpeB3B63Zln+AVdfhYeqKpV3nMkb7b4nDCFz0Tth3D?=
 =?us-ascii?Q?0hn/p/38/iHANq2mOi3pczp4?=
X-OriginatorOrg: Nvidia.com
X-MS-Exchange-CrossTenant-Network-Message-Id: b9553774-47e9-439b-818c-08d97d1e75c7
X-MS-Exchange-CrossTenant-AuthSource: BL0PR12MB5506.namprd12.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 21 Sep 2021 16:40:03.1301
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: s9zzdq8kjxBsS73JEOCxPrrPlDNu0hNcsOZw/NktnLcHeXrnpVsiQ6Q+iGDZgq5j
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BL1PR12MB5174
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Sun, Sep 19, 2021 at 02:38:33PM +0800, Liu Yi L wrote:
> This patch exposes the device-centric interface for vfio-pci devices. To
> be compatiable with existing users, vfio-pci exposes both legacy group
> interface and device-centric interface.
> 
> As explained in last patch, this change doesn't apply to devices which
> cannot be forced to snoop cache by their upstream iommu. Such devices
> are still expected to be opened via the legacy group interface.
> 
> When the device is opened via /dev/vfio/devices, vfio-pci should prevent
> the user from accessing the assigned device because the device is still
> attached to the default domain which may allow user-initiated DMAs to
> touch arbitrary place. The user access must be blocked until the device
> is later bound to an iommufd (see patch 08). The binding acts as the
> contract for putting the device in a security context which ensures user-
> initiated DMAs via this device cannot harm the rest of the system.
> 
> This patch introduces a vdev->block_access flag for this purpose. It's set
> when the device is opened via /dev/vfio/devices and cleared after binding
> to iommufd succeeds. mmap and r/w handlers check this flag to decide whether
> user access should be blocked or not.

This should not be in vfio_pci.

AFAIK there is no condition where a vfio driver can work without being
connected to some kind of iommu back end, so the core code should
handle this interlock globally. A vfio driver's ops should not be
callable until the iommu is connected.

The only vfio_pci patch in this series should be adding a new callback
op to take in an iommufd and register the pci_device as a iommufd
device.

Jason