Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Date:   Tue, 28 Sep 2021 08:54:31 -0300
From:   Jason Gunthorpe <jgg@nvidia.com>
To:     "Tian, Kevin" <kevin.tian@intel.com>
Cc:     "kvm@vger.kernel.org" <kvm@vger.kernel.org>,
        "jasowang@redhat.com" <jasowang@redhat.com>,
        "kwankhede@nvidia.com" <kwankhede@nvidia.com>,
        "hch@lst.de" <hch@lst.de>,
        "jean-philippe@linaro.org" <jean-philippe@linaro.org>,
        "Jiang, Dave" <dave.jiang@intel.com>,
        "Raj, Ashok" <ashok.raj@intel.com>,
        "corbet@lwn.net" <corbet@lwn.net>,
        "parav@mellanox.com" <parav@mellanox.com>,
        "alex.williamson@redhat.com" <alex.williamson@redhat.com>,
        "lkml@metux.net" <lkml@metux.net>,
        "david@gibson.dropbear.id.au" <david@gibson.dropbear.id.au>,
        "dwmw2@infradead.org" <dwmw2@infradead.org>,
        "Tian, Jun J" <jun.j.tian@intel.com>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        "lushenming@huawei.com" <lushenming@huawei.com>,
        "pbonzini@redhat.com" <pbonzini@redhat.com>,
        "robin.murphy@arm.com" <robin.murphy@arm.com>
Subject: Re: [RFC 06/20] iommu: Add iommu_device_init[exit]_user_dma
 interfaces
Message-ID: <20210928115431.GJ964074@nvidia.com>
References: <20210921170943.GS327412@nvidia.com>
 <BN9PR11MB5433DA330D4583387B59AA7F8CA29@BN9PR11MB5433.namprd11.prod.outlook.com>
 <20210922123931.GI327412@nvidia.com>
 <BN9PR11MB5433CE19425E85E7F52093278CA79@BN9PR11MB5433.namprd11.prod.outlook.com>
 <20210927115342.GW964074@nvidia.com>
 <BN9PR11MB5433502FEF11940984774F278CA79@BN9PR11MB5433.namprd11.prod.outlook.com>
 <20210927130935.GZ964074@nvidia.com>
 <BN9PR11MB543327D25DCE242919F7909A8CA79@BN9PR11MB5433.namprd11.prod.outlook.com>
 <20210927143947.GA964074@nvidia.com>
 <BN9PR11MB5433CE9B63FD6E784F0196B68CA89@BN9PR11MB5433.namprd11.prod.outlook.com>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <BN9PR11MB5433CE9B63FD6E784F0196B68CA89@BN9PR11MB5433.namprd11.prod.outlook.com>
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?+VKJQu3YZpuZiEmoZaKGEJY6EqS0udGquoIrBWUmdC3/MbRxGZItsaTaDB5k?=
 =?us-ascii?Q?z9UPUpuFyj1SFPQIlvj2oslqtRn25hAoqqX1lfEw1tgEKhNgHAu2CEJw/pGm?=
 =?us-ascii?Q?b7NuQdjBO+O03vnxPXqd9OwScxGheQuik7+F3p9B2ufX1bdRX9Ww7xRrkjNg?=
 =?us-ascii?Q?/VDZSCRhc65y4vIb99879MS2H4TCKcFIblJbogtaW9dkw3NWS4LAnhPSp3nz?=
 =?us-ascii?Q?7cxt4rfIA4/kfmLA4Xd76t8JB6bJbwFIn52EcgDJKPyS9+mfeT5qx2kH++A3?=
 =?us-ascii?Q?gH4LxcpUE7Bs5usUoD2zhj2VEuoCbYkKN9PdBXFnCpwXMWgtqI5iQMTQacoa?=
 =?us-ascii?Q?9pkYK95AsJlt83IBC36Hp7IOf+KDAVwpA0D3uN3nzznrDUkLKnksRGQZATmX?=
 =?us-ascii?Q?Q6WF5CApwxPn5wLpIMmctO0GafhojpQvlz1Ho4SvaJVT0JWMuKw7/sRJ/Xyd?=
 =?us-ascii?Q?Uwil/fuhgedv/+btlw6FutKemrFtddyFcjs/Zxy1aZYsid9hri68/Rh7naDc?=
 =?us-ascii?Q?OQQl/BoTC6+Qo1tOU90BAKJwqFdeVhq8jqj4FdRwWc7skVnxpVSiKk99CGkL?=
 =?us-ascii?Q?AX5ydW1YUDh81eUOcFtGUfZwF2scEbpcnQlTRe0MP0F/Nkyx0YTEKe4PmZKv?=
 =?us-ascii?Q?bGnTwjHaPa3tusG/75lBWiISUnx3+/Nxp3vXC2+eyFJbDNCIV4dGvrseMl37?=
 =?us-ascii?Q?k1zZYr6XosBpfQxnp7OLIDqZgPzYKUzLQ8sfqO2kfnvIOZ89okuog3mdSH9+?=
 =?us-ascii?Q?4w/LlEhz+0gBqb683HaUFk0KxfrL2j55KjN1dn3RU+o/YZT/xuNgXLdA+DnE?=
 =?us-ascii?Q?bdAhXAM42u2QWYJocwWkuXUm86OHU6spHlbaxJtWSk3GON85ajICO20fBuuw?=
 =?us-ascii?Q?ltIVdM4Symv/L0T+DfTLwrgxfl1FkfYmW7e4YC/fUo91p9gujnuqok6Nk7zL?=
 =?us-ascii?Q?29dwuxxULm70br+hgqu7JVla0tsefu5IIP0Zy0rh5JC+rb119tndR9g6q1jC?=
 =?us-ascii?Q?JEY2zW6b5HlTRWQRaj8G/pZuJqgzNBFUEXrvIerFbp3hvBg1PbKwldN1neQN?=
 =?us-ascii?Q?/RYVAUCjd9WtJhn2rqFCnG9tQ42NwHp4PipfuB0Q8BE/5rxoeSN4Yw0YAQJy?=
 =?us-ascii?Q?EDQHHsgNWQVQ8e/Fud+8qb6hXaOgQLu7u1cw1Gszpum5V7yNSB5tD1zY2Nh1?=
 =?us-ascii?Q?NItv8/e4F4jURHVqg3mFEwUWVrapXxFRaa/xOhY/0xUjOySaiLajIPyYdhZe?=
 =?us-ascii?Q?GPpLYFzJ1pArIEyY5EcYoyBySTyPOXmZZoHETuokur103vWtvSLIuSb10MQm?=
 =?us-ascii?Q?0CkHbo9iCfGB5j8874w06wly?=
X-OriginatorOrg: Nvidia.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 989a851c-7ed7-402c-79f6-08d98276bc37
X-MS-Exchange-CrossTenant-AuthSource: BL0PR12MB5506.namprd12.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 28 Sep 2021 11:54:32.7927
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: buA4yaYRhU0MFMaGpsv4VUVKSnq+CieHwy594pEwmYH7yTmhIWmSch43ocKMUYbK
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BL0PR12MB5507
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Tue, Sep 28, 2021 at 07:13:01AM +0000, Tian, Kevin wrote:
> > From: Jason Gunthorpe <jgg@nvidia.com>
> > Sent: Monday, September 27, 2021 10:40 PM
> > 
> > On Mon, Sep 27, 2021 at 01:32:34PM +0000, Tian, Kevin wrote:
> > 
> > > but I'm little worried that even vfio-pci itself cannot be bound now,
> > > which implies that all devices in a group which are intended to be
> > > used by the user must be bound to vfio-pci in a breath before the
> > > user attempts to open any of them, i.e. late-binding and device-
> > > hotplug is disallowed after the initial open. I'm not sure how
> > > important such an usage would be, but it does cause user-tangible
> > > semantics change.
> > 
> > Oh, that's bad..
> > 
> > I guess your approach is the only way forward, it will have to be
> > extensively justified in the commit message for Greg et al.
> > 
> 
> Just thought about another alternative. What about having driver
> core to call iommu after call_driver_probe()?

Then the kernel is now already exposed to an insecure scenario, we
must not do probe if any user device is attached at all.

Jason