Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   "Tian, Kevin" <kevin.tian@intel.com>
To:     Jason Gunthorpe <jgg@nvidia.com>
CC:     "kvm@vger.kernel.org" <kvm@vger.kernel.org>,
        "jasowang@redhat.com" <jasowang@redhat.com>,
        "kwankhede@nvidia.com" <kwankhede@nvidia.com>,
        "hch@lst.de" <hch@lst.de>,
        "jean-philippe@linaro.org" <jean-philippe@linaro.org>,
        "Jiang, Dave" <dave.jiang@intel.com>,
        "Raj, Ashok" <ashok.raj@intel.com>,
        "corbet@lwn.net" <corbet@lwn.net>,
        "parav@mellanox.com" <parav@mellanox.com>,
        "alex.williamson@redhat.com" <alex.williamson@redhat.com>,
        "lkml@metux.net" <lkml@metux.net>,
        "david@gibson.dropbear.id.au" <david@gibson.dropbear.id.au>,
        "dwmw2@infradead.org" <dwmw2@infradead.org>,
        "Tian, Jun J" <jun.j.tian@intel.com>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        "lushenming@huawei.com" <lushenming@huawei.com>,
        "pbonzini@redhat.com" <pbonzini@redhat.com>,
        "robin.murphy@arm.com" <robin.murphy@arm.com>
Subject: RE: [RFC 06/20] iommu: Add iommu_device_init[exit]_user_dma
 interfaces
Thread-Topic: [RFC 06/20] iommu: Add iommu_device_init[exit]_user_dma
 interfaces
Thread-Index: AQHXrSF9WDj+Z+DU+UqMJ7tQK2EdmauuvK2AgACKnbCAALw6gIAHYVYAgABthQCAABACQIAABTKAgAAAdqCAABi9gIABEGXAgABTw4CAAMklcA==
Date:   Tue, 28 Sep 2021 23:59:50 +0000
Message-ID: <BN9PR11MB5433E6CB4CC0F96DB6E00D978CA89@BN9PR11MB5433.namprd11.prod.outlook.com>
References: <20210921170943.GS327412@nvidia.com>
 <BN9PR11MB5433DA330D4583387B59AA7F8CA29@BN9PR11MB5433.namprd11.prod.outlook.com>
 <20210922123931.GI327412@nvidia.com>
 <BN9PR11MB5433CE19425E85E7F52093278CA79@BN9PR11MB5433.namprd11.prod.outlook.com>
 <20210927115342.GW964074@nvidia.com>
 <BN9PR11MB5433502FEF11940984774F278CA79@BN9PR11MB5433.namprd11.prod.outlook.com>
 <20210927130935.GZ964074@nvidia.com>
 <BN9PR11MB543327D25DCE242919F7909A8CA79@BN9PR11MB5433.namprd11.prod.outlook.com>
 <20210927143947.GA964074@nvidia.com>
 <BN9PR11MB5433CE9B63FD6E784F0196B68CA89@BN9PR11MB5433.namprd11.prod.outlook.com>
 <20210928115431.GJ964074@nvidia.com>
In-Reply-To: <20210928115431.GJ964074@nvidia.com>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?PrvOHeEuDeZ84N99KO86AcHY6ZZb3k0yxC57zQna6pIcrMot5yoDc/Jotm/8?=
 =?us-ascii?Q?jlQvqK3q/JQIDILhXc7BxDy4mB0bLVgC36AaOV+HcIjyTSqIT3sdfqOVR5xW?=
 =?us-ascii?Q?tiwcukBpYmNxJdmTKfaYfEepqC6OUIO7HF+piipS0pBeyHad1YRCG1BmtvNJ?=
 =?us-ascii?Q?OFTap+Dl1lDNVZ/D3EoF9FhsvqsI4OBjindrGS6xCqcwQtx1VNjlZtAA44tU?=
 =?us-ascii?Q?4YZM9ckXVVrVsuBre6QY7RMj1B3RTxOEAJXtHDY9Ju82+ua95HVmHahyDH+y?=
 =?us-ascii?Q?6Y/hu/l3udCVh57OQlGD65k8Wsrbwd3eoJfTxFXncfG2c22zwezVPIejjWn3?=
 =?us-ascii?Q?LbhJZsAy1XgvwxUaYJ3M+aZmEfZWzos19Cr9Y83xM1r47tFd0kaYNi7ke5lW?=
 =?us-ascii?Q?vIjQaNsGBwHz972MSSqes7Z3wmlfOeQ7lhKYqjMzjrA6XlZ1t2JC96gsekQa?=
 =?us-ascii?Q?3LhGGIsBDDBG5jauH5sqef6Qb4axIu1dmdPSNb7y1GeCfypL42w/pAo9/Tiy?=
 =?us-ascii?Q?SoQvoEZjmHuWJxEppnf9sGfeSo32tJnioRUmS0sjziICCqNrb0u5EC44U93F?=
 =?us-ascii?Q?lAiPAQDgxeQADZCltcZOv8ff0St3s4XI5tL3wXvhzSeEO2v7WMU5LkFS3ba6?=
 =?us-ascii?Q?ox1uVyCpn4y0Ie+zpj1w+Lwe/9HYDTMYsQTYEirgHXrIrPNGGi9HOn0omKZp?=
 =?us-ascii?Q?XUTWsrwC4Mq5d0dTh6jHVuTVwtCIv/cPMjAOyy6vB6lCNlECKvlEXv/I1xDl?=
 =?us-ascii?Q?J1tjacHPFrccFRZmJew1KhHY01AhZSO6hpZZ2PsgnDlrJoWZkvx1BXsGTEzZ?=
 =?us-ascii?Q?awAdZizA5OQQqSUfXWYn21WuL+c2gp5ditfsxqzletY5L8I37k4lvgY8jbs+?=
 =?us-ascii?Q?FQ4RfJ0Um+XUoV8EmLjH5PrH3VKichXM29cFKPOTzagVh5A/wC6yOyZK8eYT?=
 =?us-ascii?Q?tZ/avO8LHu+MDThuMiLtI+F3wpqsCXnhdbR9Epy/vpGZ758qVFSrZ7eJLLOQ?=
 =?us-ascii?Q?1t1u7qugp6Id8LHp1vD+aYKMig9dTwSKtb1QcXmlVO5x87Lt882dyFZyDShm?=
 =?us-ascii?Q?PEcxBzzp0BKydYnGEEnjIhH/sywmiS/nx8A7r85xspkfoQLeAIr3o207YCUu?=
 =?us-ascii?Q?wyOr0qBg/ZF3U5jyYCKlNeGtPfaKCfXnWfhnEXKfzV5l/3qsC8ch9vjrsGEZ?=
 =?us-ascii?Q?5vkfzwfqQXqjRFnQc6CfU3eP+mchTr89ufQ21bG6xcDz0aiwf6tOnx9LSbr8?=
 =?us-ascii?Q?IGCF4xRsakO28WgcLbTnWDIqwqxMWmcOkQh35sarCZc8zAGnKsByntDN9ZFK?=
 =?us-ascii?Q?Wy0=3D?=
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: BN9PR11MB5433.namprd11.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: aa64c73c-1ed7-4bf0-898b-08d982dc0f36
X-MS-Exchange-CrossTenant-originalarrivaltime: 28 Sep 2021 23:59:50.8338
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 46c98d88-e344-4ed4-8496-4ed7712e255d
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: bUrDry/12cPSSWUnqd8iCOAfhlJLqvyhOcb3ILhPKfLNYedbhhuZpiovBNlIeHUJdmTcB592xNXiSPK4nsOz3A==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN0PR11MB5759
X-OriginatorOrg: intel.com
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

> From: Jason Gunthorpe <jgg@nvidia.com>
> Sent: Tuesday, September 28, 2021 7:55 PM
>=20
> On Tue, Sep 28, 2021 at 07:13:01AM +0000, Tian, Kevin wrote:
> > > From: Jason Gunthorpe <jgg@nvidia.com>
> > > Sent: Monday, September 27, 2021 10:40 PM
> > >
> > > On Mon, Sep 27, 2021 at 01:32:34PM +0000, Tian, Kevin wrote:
> > >
> > > > but I'm little worried that even vfio-pci itself cannot be bound no=
w,
> > > > which implies that all devices in a group which are intended to be
> > > > used by the user must be bound to vfio-pci in a breath before the
> > > > user attempts to open any of them, i.e. late-binding and device-
> > > > hotplug is disallowed after the initial open. I'm not sure how
> > > > important such an usage would be, but it does cause user-tangible
> > > > semantics change.
> > >
> > > Oh, that's bad..
> > >
> > > I guess your approach is the only way forward, it will have to be
> > > extensively justified in the commit message for Greg et al.
> > >
> >
> > Just thought about another alternative. What about having driver
> > core to call iommu after call_driver_probe()?
>=20
> Then the kernel is now already exposed to an insecure scenario, we
> must not do probe if any user device is attached at all.
>=20

Originally I thought it's fine as long as the entire probe process
is not completed. Based on your comment I feel your concern is
that no guarantee that the driver won't do any iommu related=20
work in its probe function thus it's insecure?

Thanks
Kevin