Re: [PATCH 0/5] iommu/virtio: Add identity domains

2021-10-22 Thread Jean-Philippe Brucker
On Fri, Oct 22, 2021 at 06:16:27AM -0400, Michael S. Tsirkin wrote: > On Wed, Oct 13, 2021 at 01:10:48PM +0100, Jean-Philippe Brucker wrote: > > Support identity domains, allowing to only enable IOMMU protection for a > > subset of endpoints (those assigned to userspace, for example). Users > > may

Re: [PATCH 0/5] iommu/virtio: Add identity domains

2021-10-22 Thread Michael S. Tsirkin
On Wed, Oct 13, 2021 at 01:10:48PM +0100, Jean-Philippe Brucker wrote: > Support identity domains, allowing to only enable IOMMU protection for a > subset of endpoints (those assigned to userspace, for example). Users > may enable identity domains at compile time > (CONFIG_IOMMU_DEFAULT_PASSTHROUGH

RE: [PATCH 0/5] iommu/virtio: Add identity domains

2021-10-20 Thread Tian, Kevin
> From: Jean-Philippe Brucker > Sent: Wednesday, October 13, 2021 8:11 PM > > Support identity domains, allowing to only enable IOMMU protection for a > subset of endpoints (those assigned to userspace, for example). Users > may enable identity domains at compile time > (CONFIG_IOMMU_DEFAULT_PASS

RE: [PATCH 0/5] iommu/virtio: Add identity domains

2021-10-20 Thread Tian, Kevin
> From: Jean-Philippe Brucker > Sent: Monday, October 18, 2021 11:24 PM > > On Thu, Oct 14, 2021 at 03:00:38AM +, Tian, Kevin wrote: > > > From: Jean-Philippe Brucker > > > Sent: Wednesday, October 13, 2021 8:11 PM > > > > > > Support identity domains, allowing to only enable IOMMU protectio

RE: [PATCH 0/5] iommu/virtio: Add identity domains

2021-10-20 Thread Tian, Kevin
> From: j...@8bytes.org > Sent: Monday, October 18, 2021 7:38 PM > > On Thu, Oct 14, 2021 at 03:00:38AM +, Tian, Kevin wrote: > > I saw a concept of deferred attach in iommu core. See iommu_is_ > > attach_deferred(). Currently this is vendor specific and I haven't > > looked into the exact re

Re: [PATCH 0/5] iommu/virtio: Add identity domains

2021-10-19 Thread Jean-Philippe Brucker
On Tue, Oct 19, 2021 at 09:22:13AM +0800, Jason Wang wrote: > > > So I think clarifying system reset should address your questions. > > > I believe we should leave bypass sticky across device reset, so a FW->OS > > > transition, where the OS resets the device, does not open a vulnerability > > > (i

Re: [PATCH 0/5] iommu/virtio: Add identity domains

2021-10-18 Thread Jason Wang
On Mon, Oct 18, 2021 at 11:35 PM Michael S. Tsirkin wrote: > > On Mon, Oct 18, 2021 at 04:23:41PM +0100, Jean-Philippe Brucker wrote: > > On Thu, Oct 14, 2021 at 03:00:38AM +, Tian, Kevin wrote: > > > > From: Jean-Philippe Brucker > > > > Sent: Wednesday, October 13, 2021 8:11 PM > > > > > >

Re: [PATCH 0/5] iommu/virtio: Add identity domains

2021-10-18 Thread Michael S. Tsirkin
On Mon, Oct 18, 2021 at 04:23:41PM +0100, Jean-Philippe Brucker wrote: > On Thu, Oct 14, 2021 at 03:00:38AM +, Tian, Kevin wrote: > > > From: Jean-Philippe Brucker > > > Sent: Wednesday, October 13, 2021 8:11 PM > > > > > > Support identity domains, allowing to only enable IOMMU protection fo

Re: [PATCH 0/5] iommu/virtio: Add identity domains

2021-10-18 Thread Jean-Philippe Brucker
On Thu, Oct 14, 2021 at 03:00:38AM +, Tian, Kevin wrote: > > From: Jean-Philippe Brucker > > Sent: Wednesday, October 13, 2021 8:11 PM > > > > Support identity domains, allowing to only enable IOMMU protection for a > > subset of endpoints (those assigned to userspace, for example). Users > >

Re: [PATCH 0/5] iommu/virtio: Add identity domains

2021-10-18 Thread j...@8bytes.org
On Thu, Oct 14, 2021 at 03:00:38AM +, Tian, Kevin wrote: > I saw a concept of deferred attach in iommu core. See iommu_is_ > attach_deferred(). Currently this is vendor specific and I haven't > looked into the exact reason why some vendor sets it now. Just > be curious whether the same reason m

RE: [PATCH 0/5] iommu/virtio: Add identity domains

2021-10-13 Thread Tian, Kevin
> From: Jean-Philippe Brucker > Sent: Wednesday, October 13, 2021 8:11 PM > > Support identity domains, allowing to only enable IOMMU protection for a > subset of endpoints (those assigned to userspace, for example). Users > may enable identity domains at compile time > (CONFIG_IOMMU_DEFAULT_PASS

[PATCH 0/5] iommu/virtio: Add identity domains

2021-10-13 Thread Jean-Philippe Brucker
Support identity domains, allowing to only enable IOMMU protection for a subset of endpoints (those assigned to userspace, for example). Users may enable identity domains at compile time (CONFIG_IOMMU_DEFAULT_PASSTHROUGH), boot time (iommu.passthrough=1) or runtime (/sys/kernel/iommu_groups/*/type