On Tue, Oct 15, 2024 at 04:13:13PM +0100, Robin Murphy wrote: > On 2024-10-15 1:47 pm, Jason Gunthorpe wrote: > > On Tue, Oct 15, 2024 at 08:13:28AM +0000, Pranjal Shrivastava wrote: > > > > > Umm.. this was specific for rmr not a generic thing. I'd suggest to > > > avoid meddling with the STEs directly for acheiving bypass. Playing > > > with the iommu domain type could be neater. Perhaps, modify the > > > ops->def_domain_type to return an appropriate domain? > > > > Yeah, that is the expected way, to force the def_domain_type to > > IDENTITY and refuse to attach a PAGING/BLOCKED domain. > > There is no domain, this is bypassing an arbitrary StreamID not associated > with any device. If the stream ID is going to flow traffic shouldn't it have a DT node for it? Something must be driving the DMA on this SID, and the kernel does need to know what that is in some way, even for basic security things like making sure VFIO doesn't get a hold of it :\ Jason
