Received-SPF: pass (google.com: domain of linux-kernel+bounces-212374-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45e3:2400::1 as permitted sender) client-ip=2604:1380:45e3:2400::1;
Date: Wed, 12 Jun 2024 20:23:01 -0300
From: Jason Gunthorpe <jgg@nvidia.com>
To: Bjorn Helgaas <helgaas@kernel.org>
Cc: Vidya Sagar <vidyas@nvidia.com>, "corbet@lwn.net" <corbet@lwn.net>,
	"bhelgaas@google.com" <bhelgaas@google.com>,
	Gal Shalom <galshalom@nvidia.com>,
	Leon Romanovsky <leonro@nvidia.com>,
	Thierry Reding <treding@nvidia.com>,
	Jon Hunter <jonathanh@nvidia.com>,
	Masoud Moshref Javadi <mmoshrefjava@nvidia.com>,
	Shahaf Shuler <shahafs@nvidia.com>,
	Vikram Sethi <vsethi@nvidia.com>,
	Shanker Donthineni <sdonthineni@nvidia.com>,
	Jiandi An <jan@nvidia.com>, Tushar Dave <tdave@nvidia.com>,
	"linux-doc@vger.kernel.org" <linux-doc@vger.kernel.org>,
	"linux-pci@vger.kernel.org" <linux-pci@vger.kernel.org>,
	"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
	Krishna Thota <kthota@nvidia.com>,
	Manikanta Maddireddy <mmaddireddy@nvidia.com>,
	"sagar.tv@gmail.com" <sagar.tv@gmail.com>,
	Joerg Roedel <joro@8bytes.org>, Will Deacon <will@kernel.org>,
	Robin Murphy <robin.murphy@arm.com>,
	"iommu@lists.linux.dev" <iommu@lists.linux.dev>,
	Alex Williamson <alex.williamson@redhat.com>
Subject: Re: [PATCH V3] PCI: Extend ACS configurability
Message-ID: <20240612232301.GB19897@nvidia.com>
References: <20240610113849.GO19897@nvidia.com>
 <20240612212903.GA1037897@bhelgaas>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20240612212903.GA1037897@bhelgaas>
Precedence: bulk
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0:
	=?us-ascii?Q?iKUHIjcSXgaChRnvZV3iCJTZn1VcxacknrxAtUV2YvUZzNNzEV9606vMCJYe?=
 =?us-ascii?Q?Km4aFsywVRe1ju9o6LRj4JB7aKouUOA102/tCH4S+ajJz+AZQAapmeFoGvlq?=
 =?us-ascii?Q?CilMaugtIgmYUGynUvfnTqkEvCoQIIv3jQuVL9XPXC8XDEZHg79t7unCiKAd?=
 =?us-ascii?Q?Sd4cY7un4x7vcT8yQCxtkA6u+1TupDCZ6+E3gFHRWy0F+G+PRDg5dW1kgAel?=
 =?us-ascii?Q?In321b8ieGJbSt6tJ0AKDp3uOdT2UEUQeFCLRYzh7c7kZY76DXPgmJroxLRg?=
 =?us-ascii?Q?G6Q6IK9vl1qIVJgnIsk1pZisbSw8edWoq9JEm7a4NJbOIBioh9PGi7bVZv5p?=
 =?us-ascii?Q?BxujxJ6WYZmfThtpN+qjEzK0nQLcKOTMcYYL2I1Pf5M794W+088dDDzV5Pa6?=
 =?us-ascii?Q?TI7QuajZOArMN1UnYAFq6aIKgFM3MXvLYfENJMTr5pNIr86d/KmMdwGKWhp5?=
 =?us-ascii?Q?V6xOn9ma9IWj8V1NKwMkA0FCnx+pjYugDqwNitTtkx67bNA5cw6NcH76g2Yq?=
 =?us-ascii?Q?scZEDCnpRrBD7ulU1P70Aic8e09ay+FX2d3kxp+pPnkmMMRZDnZCaYoUdh7j?=
 =?us-ascii?Q?QfThk0u9ZBq71fM2OAPLv1r8cl9gwl60/3S67Hxmkt0tL+HjZArxDoy6kvjX?=
 =?us-ascii?Q?2YVeGTRADI7yDOOYP9pQeUrVxfmCR8Y9zpVZ0t8H8/IO/Sb/XWnPARFzXsOL?=
 =?us-ascii?Q?SokJyeY2G8e7irq0qlaJ2sZp3vu+puaCSGwAerMWb2PJJ2leMb+m1MveeCsF?=
 =?us-ascii?Q?3A1PEMDJIJA5x4UaLGeVegpJt3CSmMiQN0P5kB7KYhU83Ptg2ajVARAP7YlE?=
 =?us-ascii?Q?8FYpSiOZS2vR4gwN+qbMR8RKilOgly9+k5Uil+NzWJ4cMBmti2ModvLg+kyf?=
 =?us-ascii?Q?kE6T70bcjx6updt2Z8iVtwYgTKmTfWamjEQFpwrqDMzPVFm06d02kHtKYO2+?=
 =?us-ascii?Q?fAYWJ3DlTfhZB2GmuwDW/3lvFXbmAYoHNYuQTJTFcJjSez74ZCBNiaGm/GG0?=
 =?us-ascii?Q?tIpLurKGE6BNc2CAq04Y+WzeMIEASeHTe/ydTVhBhNvXt4JbSzofequ/4BNu?=
 =?us-ascii?Q?E0R5LbhsB45LvMwQqY2iX1rsfB5oc62E8CB/eQxW3rYl9Jj6O4A3wkUvD2L0?=
 =?us-ascii?Q?zH40P4oQfWazkuw1eVXYwbQ4hL0CEdTihSAG2OYG2zrCg+vwNHAGrK9G0q21?=
 =?us-ascii?Q?cjOXfUIvv5E01qf4QYO+SNlQxWpiPb7tJmjGs6Bp5OieipZHxOjA5xLQaDUM?=
 =?us-ascii?Q?gSM/XAo+319Gu4sBlYgX4mKRKgj2Y7Fa/+SfZsj4CQSvHzhURSuhna+j1+9U?=
 =?us-ascii?Q?Lustq/rE1Cwg1wtnUpvmnqwKOqijOcCsAAqzwm1F5UD5+JApzWU+R83z1WIp?=
 =?us-ascii?Q?PdOUE6OxU2NEA9F9SyrjQ1ysBX4gC35s+9Gnmt6JdRXpALtRRovof66gETcx?=
 =?us-ascii?Q?I/NcvIDQauUmXgy7fFaD//xuzWNUI12G0f7ahszmnSPGZoFcAWYKOI6OlJ+M?=
 =?us-ascii?Q?/H8llbudoznJG4+Yk3P+y0kd8F1koxETy6HcZ/5ZNBAG6x45v4bVk4Nqw05F?=
 =?us-ascii?Q?s4l2glrqyzwuUPXpjHAu24efNjPNl+Q9nnCNmNf7?=
X-OriginatorOrg: Nvidia.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 6c836eba-13a7-400b-3af1-08dc8b369c04
X-MS-Exchange-CrossTenant-AuthSource: DM6PR12MB3849.namprd12.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 12 Jun 2024 23:23:04.4430
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: 2bF2DwHetMovWSAgkOG3HMssaq88O42z5WBSWs0kCJAtmfZgWNf8qn69VDpkelzq
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY8PR12MB8313

On Wed, Jun 12, 2024 at 04:29:03PM -0500, Bjorn Helgaas wrote:
> [+cc Alex since VFIO entered the conversation; thread at
> https://lore.kernel.org/r/20240523063528.199908-1-vidyas@nvidia.com]
> 
> On Mon, Jun 10, 2024 at 08:38:49AM -0300, Jason Gunthorpe wrote:
> > On Fri, Jun 07, 2024 at 02:30:55PM -0500, Bjorn Helgaas wrote:
> > > "Correctly" is not quite the right word here; it's just a fact that
> > > the ACS settings determined at boot time result in certain IOMMU
> > > groups.  If the user desires different groups, it's not that something
> > > is "incorrect"; it's just that the user may have to accept less
> > > isolation to get the desired IOMMU groups.
> > 
> > That is not quite accurate.. There are HW configurations where ACS
> > needs to be a certain way for the HW to work with P2P at all. It isn't
> > just an optimization or the user accepts something, if they want P2P
> > at all they must get a ACS configuration appropriate for their system.
> 
> The current wording of "For iommu_groups to form correctly, the ACS
> settings in the PCIe fabric need to be setup early" suggests that the
> way we currently configure ACS is incorrect in general, regardless of
> P2PDMA.

Yes, I'd agree with this. We don't have enough information to
configurate it properly in the kernel in an automatic way. We don't
know if pairs of devices even have SW enablement to do P2P in the
kernel and we don't accurately know what issues the root complex
has. All of this information goes into choosing the right ACS bits.

> But my impression is that there's a trade-off between isolation and
> the ability to do P2PDMA, and users have different requirements, and
> the preference for less isolation/more P2PDMA is no more "correct"
> than a preference for more isolation/less P2PDMA.

Sure, that makes sense
 
> Maybe something like this:
> 
>   PCIe ACS settings determine how devices are put into iommu_groups.
>   The iommu_groups in turn determine which devices can be passed
>   through to VMs and whether P2PDMA between them is possible.  The
>   iommu_groups are built at enumeration-time and are currently static.

Not quite, the iommu_groups don't have alot to do with the P2P. Even
devices in the same kernel group can still have non working P2P.

Maybe:

 PCIe ACS settings control the level of isolation and the possible P2P
 paths between devices. With greater isolation the kernel will create
 smaller iommu_groups and with less isolation there is more HW that
 can achieve P2P transfers. From a virtualization perspective all
 devices in the same iommu_group must be assigned to the same VM as
 they lack security isolation.

 There is no way for the kernel to automatically know the correct
 ACS settings for any given system and workload. Existing command line
 options allow only for large scale change, disabling all
 isolation, but this is not sufficient for more complex cases.

 Add a kernel command-line option to directly control all the ACS bits
 for specific devices, which allows the operator to setup the right
 level of isolation to achieve the desired P2P configuration. The
 definition is future proof, when new ACS bits are added to the spec
 the open syntax can be extended.

 ACS needs to be setup early in the kernel boot as the ACS settings
 effect how iommu_groups are formed. iommu_group formation is a one
 time event during initial device discovery, changing ACS bits after
 kernel boot can result in an inaccurate view of the iommu_groups
 compared to the current isolation configuration.
 
 ACS applies to PCIe Downstream Ports and multi-function devices.
 The default ACS settings are strict and deny any direct traffic
 between two functions. This results in the smallest iommu_group the
 HW can support. Frequently these values result in slow or
 non-working P2PDMA.

 ACS offers a range of security choices controlling how traffic is
 allowed to go directly between two devices. Some popular choices:
   - Full prevention
   - Translated requests can be direct, with various options
   - Asymetric direct traffic, A can reach B but not the reverse
   - All traffic can be direct
 Along with some other less common ones for special topologies.

 The intention is that this option would be used with expert knowledge
 of the HW capability and workload to achieve the desired
 configuration.

Jason