[PATCH v2 1/1] iommu: Allow attaching static domains in iommu_attach_device_pasid()

[PATCH v2 1/1] iommu: Allow attaching static domains in iommu_attach_device_pasid()

[Lu Baolu]

The idxd driver attaches the default domain to a PASID of the device to
perform kernel DMA using that PASID. The domain is attached to the
device's PASID through iommu_attach_device_pasid(), which checks if the
domain->owner matches the iommu_ops retrieved from the device. If they
do not match, it returns a failure.

        if (ops != domain->owner || pasid == IOMMU_NO_PASID)
                return -EINVAL;

The static identity domain implemented by the intel iommu driver doesn't
specify the domain owner. Therefore, kernel DMA with PASID doesn't work
for the idxd driver if the device translation mode is set to passthrough.

Generally the owner field of static domains are not set because they are
already part of iommu ops. Add a helper domain_iommu_ops_compatible()
that checks if a domain is compatible with the device's iommu ops. This
helper explicitly allows the static blocked and identity domains associated
with the device's iommu_ops to be considered compatible.

Fixes: 2031c469f816 ("iommu/vt-d: Add support for static identity domain")
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220031
Cc: stable@vger.kernel.org
Suggested-by: Jason Gunthorpe <jgg@nvidia.com>
Link: https://lore.kernel.org/linux-iommu/20250422191554.GC1213339@ziepe.ca/
Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
---
 drivers/iommu/iommu.c | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

Change log:
-v2:
 - Make the solution generic for all static domains as suggested by
   Jason.
-v1: https://lore.kernel.org/linux-iommu/20250422075422.2084548-1-baolu.lu@linux.intel.com/

diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c
index 4f91a740c15f..abda40ec377a 100644
--- a/drivers/iommu/iommu.c
+++ b/drivers/iommu/iommu.c
@@ -3402,6 +3402,19 @@ static void __iommu_remove_group_pasid(struct iommu_group *group,
 		iommu_remove_dev_pasid(device->dev, pasid, domain);
 }
 
+static bool domain_iommu_ops_compatible(const struct iommu_ops *ops,
+					struct iommu_domain *domain)
+{
+	if (domain->owner == ops)
+		return true;
+
+	/* For static domains, owner isn't set. */
+	if (domain == ops->blocked_domain || domain == ops->identity_domain)
+		return true;
+
+	return false;
+}
+
 /*
  * iommu_attach_device_pasid() - Attach a domain to pasid of device
  * @domain: the iommu domain.
@@ -3435,7 +3448,8 @@ int iommu_attach_device_pasid(struct iommu_domain *domain,
 	    !ops->blocked_domain->ops->set_dev_pasid)
 		return -EOPNOTSUPP;
 
-	if (ops != domain->owner || pasid == IOMMU_NO_PASID)
+	if (!domain_iommu_ops_compatible(ops, domain) ||
+	    pasid == IOMMU_NO_PASID)
 		return -EINVAL;
 
 	mutex_lock(&group->mutex);
-- 
2.43.0

Re: [PATCH v2 1/1] iommu: Allow attaching static domains in iommu_attach_device_pasid()

[Dave Jiang]

On 4/22/25 7:18 PM, Lu Baolu wrote:
> The idxd driver attaches the default domain to a PASID of the device to
> perform kernel DMA using that PASID. The domain is attached to the
> device's PASID through iommu_attach_device_pasid(), which checks if the
> domain->owner matches the iommu_ops retrieved from the device. If they
> do not match, it returns a failure.
> 
>         if (ops != domain->owner || pasid == IOMMU_NO_PASID)
>                 return -EINVAL;
> 
> The static identity domain implemented by the intel iommu driver doesn't
> specify the domain owner. Therefore, kernel DMA with PASID doesn't work
> for the idxd driver if the device translation mode is set to passthrough.
> 
> Generally the owner field of static domains are not set because they are
> already part of iommu ops. Add a helper domain_iommu_ops_compatible()
> that checks if a domain is compatible with the device's iommu ops. This
> helper explicitly allows the static blocked and identity domains associated
> with the device's iommu_ops to be considered compatible.
> 
> Fixes: 2031c469f816 ("iommu/vt-d: Add support for static identity domain")
> Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220031
> Cc: stable@vger.kernel.org
> Suggested-by: Jason Gunthorpe <jgg@nvidia.com>
> Link: https://lore.kernel.org/linux-iommu/20250422191554.GC1213339@ziepe.ca/
> Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>

> ---
>  drivers/iommu/iommu.c | 16 +++++++++++++++-
>  1 file changed, 15 insertions(+), 1 deletion(-)
> 
> Change log:
> -v2:
>  - Make the solution generic for all static domains as suggested by
>    Jason.
> -v1: https://lore.kernel.org/linux-iommu/20250422075422.2084548-1-baolu.lu@linux.intel.com/
> 
> diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c
> index 4f91a740c15f..abda40ec377a 100644
> --- a/drivers/iommu/iommu.c
> +++ b/drivers/iommu/iommu.c
> @@ -3402,6 +3402,19 @@ static void __iommu_remove_group_pasid(struct iommu_group *group,
>  		iommu_remove_dev_pasid(device->dev, pasid, domain);
>  }
>  
> +static bool domain_iommu_ops_compatible(const struct iommu_ops *ops,
> +					struct iommu_domain *domain)
> +{
> +	if (domain->owner == ops)
> +		return true;
> +
> +	/* For static domains, owner isn't set. */
> +	if (domain == ops->blocked_domain || domain == ops->identity_domain)
> +		return true;
> +
> +	return false;
> +}
> +
>  /*
>   * iommu_attach_device_pasid() - Attach a domain to pasid of device
>   * @domain: the iommu domain.
> @@ -3435,7 +3448,8 @@ int iommu_attach_device_pasid(struct iommu_domain *domain,
>  	    !ops->blocked_domain->ops->set_dev_pasid)
>  		return -EOPNOTSUPP;
>  
> -	if (ops != domain->owner || pasid == IOMMU_NO_PASID)
> +	if (!domain_iommu_ops_compatible(ops, domain) ||
> +	    pasid == IOMMU_NO_PASID)
>  		return -EINVAL;
>  
>  	mutex_lock(&group->mutex);

Re: [PATCH v2 1/1] iommu: Allow attaching static domains in iommu_attach_device_pasid()

[Jason Gunthorpe]

On Wed, Apr 23, 2025 at 10:18:39AM +0800, Lu Baolu wrote:
> @@ -3435,7 +3448,8 @@ int iommu_attach_device_pasid(struct iommu_domain *domain,
>  	    !ops->blocked_domain->ops->set_dev_pasid)
>  		return -EOPNOTSUPP;
>  
> -	if (ops != domain->owner || pasid == IOMMU_NO_PASID)
> +	if (!domain_iommu_ops_compatible(ops, domain) ||
> +	    pasid == IOMMU_NO_PASID)
>  		return -EINVAL;

Convert all the places checking domain->owner to the new function..

static int __iommu_attach_group(struct iommu_domain *domain,
				struct iommu_group *group)

int iommu_replace_device_pasid(struct iommu_domain *domain,
			       struct device *dev, ioasid_t pasid,
			       struct iommu_attach_handle *handle)

Jason

Re: [PATCH v2 1/1] iommu: Allow attaching static domains in iommu_attach_device_pasid()

[Baolu Lu]

On 4/23/25 22:21, Jason Gunthorpe wrote:
> On Wed, Apr 23, 2025 at 10:18:39AM +0800, Lu Baolu wrote:
>> @@ -3435,7 +3448,8 @@ int iommu_attach_device_pasid(struct iommu_domain *domain,
>>   	    !ops->blocked_domain->ops->set_dev_pasid)
>>   		return -EOPNOTSUPP;
>>   
>> -	if (ops != domain->owner || pasid == IOMMU_NO_PASID)
>> +	if (!domain_iommu_ops_compatible(ops, domain) ||
>> +	    pasid == IOMMU_NO_PASID)
>>   		return -EINVAL;
> Convert all the places checking domain->owner to the new function..
> 
> static int __iommu_attach_group(struct iommu_domain *domain,
> 				struct iommu_group *group)
> 
> int iommu_replace_device_pasid(struct iommu_domain *domain,
> 			       struct device *dev, ioasid_t pasid,
> 			       struct iommu_attach_handle *handle)

Sure. Will make it in a new version.

Thanks,
baolu

Re: [PATCH v2 1/1] iommu: Allow attaching static domains in iommu_attach_device_pasid()

[Robin Murphy]

On 2025-04-23 3:18 am, Lu Baolu wrote:
> The idxd driver attaches the default domain to a PASID of the device to
> perform kernel DMA using that PASID. The domain is attached to the
> device's PASID through iommu_attach_device_pasid(), which checks if the
> domain->owner matches the iommu_ops retrieved from the device. If they
> do not match, it returns a failure.
> 
>          if (ops != domain->owner || pasid == IOMMU_NO_PASID)
>                  return -EINVAL;
> 
> The static identity domain implemented by the intel iommu driver doesn't
> specify the domain owner. Therefore, kernel DMA with PASID doesn't work
> for the idxd driver if the device translation mode is set to passthrough.
> 
> Generally the owner field of static domains are not set because they are
> already part of iommu ops. Add a helper domain_iommu_ops_compatible()
> that checks if a domain is compatible with the device's iommu ops. This
> helper explicitly allows the static blocked and identity domains associated
> with the device's iommu_ops to be considered compatible.

With the other domain->owner checks also wrapped as Jason pointed out 
(since it would be weird but not impossible for static domains to get 
into those paths as well),

Reviewed-by: Robin Murphy <robin.murphy@arm.com>

> Fixes: 2031c469f816 ("iommu/vt-d: Add support for static identity domain")
> Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220031
> Cc: stable@vger.kernel.org
> Suggested-by: Jason Gunthorpe <jgg@nvidia.com>
> Link: https://lore.kernel.org/linux-iommu/20250422191554.GC1213339@ziepe.ca/
> Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
> ---
>   drivers/iommu/iommu.c | 16 +++++++++++++++-
>   1 file changed, 15 insertions(+), 1 deletion(-)
> 
> Change log:
> -v2:
>   - Make the solution generic for all static domains as suggested by
>     Jason.
> -v1: https://lore.kernel.org/linux-iommu/20250422075422.2084548-1-baolu.lu@linux.intel.com/
> 
> diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c
> index 4f91a740c15f..abda40ec377a 100644
> --- a/drivers/iommu/iommu.c
> +++ b/drivers/iommu/iommu.c
> @@ -3402,6 +3402,19 @@ static void __iommu_remove_group_pasid(struct iommu_group *group,
>   		iommu_remove_dev_pasid(device->dev, pasid, domain);
>   }
>   
> +static bool domain_iommu_ops_compatible(const struct iommu_ops *ops,
> +					struct iommu_domain *domain)
> +{
> +	if (domain->owner == ops)
> +		return true;
> +
> +	/* For static domains, owner isn't set. */
> +	if (domain == ops->blocked_domain || domain == ops->identity_domain)
> +		return true;
> +
> +	return false;
> +}
> +
>   /*
>    * iommu_attach_device_pasid() - Attach a domain to pasid of device
>    * @domain: the iommu domain.
> @@ -3435,7 +3448,8 @@ int iommu_attach_device_pasid(struct iommu_domain *domain,
>   	    !ops->blocked_domain->ops->set_dev_pasid)
>   		return -EOPNOTSUPP;
>   
> -	if (ops != domain->owner || pasid == IOMMU_NO_PASID)
> +	if (!domain_iommu_ops_compatible(ops, domain) ||
> +	    pasid == IOMMU_NO_PASID)
>   		return -EINVAL;
>   
>   	mutex_lock(&group->mutex);