On 8/28/2026 4:54 PM, Eric Auger wrote:
Hi Tao,
On 8/13/26 6:25 PM, Tao Tang wrote:
Refactor CMDQ invalidation paths to carry security state and apply cache
invalidation per sec_sid instead of globally. Add separate helpers for
invalidating all entries and for invalidating entries belonging to one
valid sec_sid.
In smmuv3, propagate the command queue sec_sid and command SSec through
CFGI and TLBI handling, and gate VMID use on the stage-2 capability of
the selected command queue, including SMMU_S_IDR1.SEL2 for a Secure
Command queue.
Keep acceleration and IOMMU notifier propagation Non-secure-only.
Commands targeting a programming interface other than Non-secure do not
reach the accelerated backend or Non-secure notifiers, while Non-secure
stage-1 CMD_TLBI_NH_ALL remains forwarded to the host.
Include the command queue SEC_SID and target SEC_SID in the relevant
invalidation tracepoints.
Could you split this patch so that the review becomes easier? The code
diff is huge and to me there are several functional aspects that can be
dealt with separately. For instance I see it handles invalidation for
both iotlb and cache hash tables. I have the feeling this could be
easily split, no?
Also we have changes to accel install_ste* smmuv3_accel_issue_inv_cmd
that look quite unrelated? Also shouldn't they enforce NS is used in
accel mode? I would put that in a separate patch anyway.
smmuv3_inv_notifiers_all() intro could be also handled in a separate patch.
Hi Eric,
I'll split this roughly as follows:
- Limit accel commands to Non-secure targets
- Limit IOMMU notifier invalidation to Non-secure targets
- Make configuration cache invalidation security-aware
- Make CMDQ TLB invalidation security-aware
Thanks for the suggestion.
Tao
