On Wed, May 17, 2023 at 01:20:51PM -0300, Jason Gunthorpe wrote:
> On Wed, May 10, 2023 at 09:11:57AM +0100, Jean-Philippe Brucker wrote:
>
> > > diff --git a/drivers/iommu/virtio-iommu.c b/drivers/iommu/virtio-iommu.c
> > > index 5b8fe9bfa9a5..3d3d4462359e 100644
> > > --- a/drivers/iommu/virtio-iommu.c
> > > +++ b/drivers/iommu/virtio-iommu.c
> > > @@ -788,6 +788,28 @@ static int viommu_attach_dev(struct iommu_domain *domain, struct device *dev)
> > > return 0;
> > > }
> > >
> > > +static void viommu_detach_dev(struct viommu_endpoint *vdev)
> > > +{
> > > + int i;
> > > + struct virtio_iommu_req_detach req;
> > > + struct viommu_domain *vdomain = vdev->vdomain;
> > > + struct iommu_fwspec *fwspec = dev_iommu_fwspec_get(vdev->dev);
> > > +
> > > + if (!vdomain)
> > > + return;
> > > +
> > > + req = (struct virtio_iommu_req_detach) {
> > > + .head.type = VIRTIO_IOMMU_T_DETACH,
> > > + .domain = cpu_to_le32(vdomain->id),
> > > + };
> > > +
> > > + for (i = 0; i < fwspec->num_ids; i++) {
> > > + req.endpoint = cpu_to_le32(fwspec->ids[i]);
> > > + WARN_ON(viommu_send_req_sync(vdev->viommu, &req, sizeof(req)));
> > > + }
> > > + vdev->vdomain = NULL;
>
> Not for this patch, but something to work on..
>
> I assume detach disconnects the container on the VFIO side and puts it
> into a BLOCKED state?
At the moment that depends on the VMM boot-bypass policy: if virtio-iommu
is booted with global-bypass set, then detaching will go back to an
identity-mapped container, not a BLOCKED state. If the global-bypass bit
is clear, then it does go back to a BLOCKED state. However QEMU has a
default policy of boot-bypass (because that allows booting a firmware or
OS that doesn't have the IOMMU drivers).
The driver can clear the global-bypass bit to change this behavior, but at
the moment we just follow the VMM boot policy.
>
> Can you wrapper this into a BLOCKED domain like we are moving drivers
> toward, and then attach the blocked domain instead of introducing this
> special case?
Yes, I think the way the virtio-iommu driver should implement BLOCKED
domains is initially clearing the global-bypass bit, and then issuing
DETACH requests when the core asks to attach a BLOCKED domain. This has
the same effect as issuing an ATTACH request with an empty domain, but
requires fewer resources in the VMM.
Thanks,
Jean
>
> I've been thinking about having some core code support to do fairly
> common pattern of 'parking' the iommu at some well defined translation
> mode, BLOCKED in this case.
>
> Thanks,
> Jason
_______________________________________________
Virtualization mailing list
Virtualization@xxxxxxxxxxxxxxxxxxxxxxxxxx
https://lists.linuxfoundation.org/mailman/listinfo/virtualization
