From mboxrd@z Thu Jan 1 00:00:00 1970 From: Jason Gunthorpe Date: Fri, 08 Jul 2022 11:55:22 +0000 Subject: Re: [PATCH kernel] powerpc/iommu: Add iommu_ops to report capabilities and allow blocking domains Message-Id: <20220708115522.GD1705032@nvidia.com> List-Id: References: <20220707135552.3688927-1-aik@ozlabs.ru> <20220707151002.GB1705032@nvidia.com> In-Reply-To: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: Alexey Kardashevskiy Cc: linuxppc-dev@lists.ozlabs.org, Robin Murphy , Michael Ellerman , Joerg Roedel , Joel Stanley , Alex Williamson , Oliver O'Halloran , kvm-ppc@vger.kernel.org, kvm@vger.kernel.org, Daniel Henrique Barboza , Fabiano Rosas , Murilo Opsfelder Araujo , Nicholas Piggin On Fri, Jul 08, 2022 at 04:34:55PM +1000, Alexey Kardashevskiy wrote: > For now I'll add a comment in spapr_tce_iommu_attach_dev() that it is fine > to do nothing as tce_iommu_take_ownership() and > tce_iommu_take_ownership_ddw() take care of not having active DMA mappings. That will still cause a security problem because tce_iommu_take_ownership()/etc are called too late. This is the moment in the flow when the ownershift must change away from the DMA API that power implements and to VFIO, not later. Jason