- kvm-io-move-websock-resource-release-to-close-method.patch [RHEL-120116] - kvm-io-fix-use-after-free-in-websocket-handshake-code.patch [RHEL-120116] - kvm-vfio-Disable-VFIO-migration-with-MultiFD-support.patch [RHEL-126573] - kvm-hw-arm-virt-Use-ACPI-PCI-hotplug-by-default-from-10..patch [RHEL-67323] - kvm-hw-arm-smmu-common-Check-SMMU-has-PCIe-Root-Complex-.patch [RHEL-73800] - kvm-hw-arm-virt-acpi-build-Re-arrange-SMMUv3-IORT-build.patch [RHEL-73800] - kvm-hw-arm-virt-acpi-build-Update-IORT-for-multiple-smmu.patch [RHEL-73800] - kvm-hw-arm-virt-Factor-out-common-SMMUV3-dt-bindings-cod.patch [RHEL-73800] - kvm-hw-arm-virt-Add-an-SMMU_IO_LEN-macro.patch [RHEL-73800] - kvm-hw-pci-Introduce-pci_setup_iommu_per_bus-for-per-bus.patch [RHEL-73800] - kvm-hw-arm-virt-Allow-user-creatable-SMMUv3-dev-instanti.patch [RHEL-73800] - kvm-qemu-options.hx-Document-the-arm-smmuv3-device.patch [RHEL-73800] - kvm-bios-tables-test-Allow-for-smmuv3-test-data.patch [RHEL-73800] - kvm-qtest-bios-tables-test-Add-tests-for-legacy-smmuv3-a.patch [RHEL-73800] - kvm-qtest-bios-tables-test-Update-tables-for-smmuv3-test.patch [RHEL-73800] - kvm-qtest-Do-not-run-bios-tables-test-on-aarch64.patch [] - Resolves: RHEL-120116 (CVE-2025-11234 qemu-kvm: VNC WebSocket handshake use-after-free [rhel-10.2]) - Resolves: RHEL-126573 (VFIO migration using multifd should be disabled by default) - Resolves: RHEL-67323 ([aarch64] Support ACPI based PCI hotplug on ARM) - Resolves: RHEL-73800 (NVIDIA:Grace-Hopper:Backport support for user-creatable nested SMMUv3 - RHEL 10.1)
151 lines
5.7 KiB
Diff
151 lines
5.7 KiB
Diff
From 34d06db7ea02cd3a0a07082fef93e08bfbf0b06a Mon Sep 17 00:00:00 2001
|
||
From: Shameer Kolothum <skolothumtho@nvidia.com>
|
||
Date: Fri, 29 Aug 2025 09:25:28 +0100
|
||
Subject: [PATCH 10/16] hw/pci: Introduce pci_setup_iommu_per_bus() for per-bus
|
||
IOMMU ops retrieval
|
||
|
||
RH-Author: Eric Auger <eric.auger@redhat.com>
|
||
RH-MergeRequest: 423: hw/arm/virt: Add support for user creatable SMMUv3 device
|
||
RH-Jira: RHEL-73800
|
||
RH-Acked-by: Gavin Shan <gshan@redhat.com>
|
||
RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
|
||
RH-Acked-by: Sebastian Ott <sebott@redhat.com>
|
||
RH-Acked-by: Donald Dutile <None>
|
||
RH-Commit: [6/11] 0c41f77254cd66a3648c14c5d4ba2dfdbd396665 (eauger1/centos-qemu-kvm)
|
||
|
||
Currently, pci_setup_iommu() registers IOMMU ops for a given PCIBus.
|
||
However, when retrieving IOMMU ops for a device using
|
||
pci_device_get_iommu_bus_devfn(), the function checks the parent_dev
|
||
and fetches IOMMU ops from the parent device, even if the current
|
||
bus does not have any associated IOMMU ops.
|
||
|
||
This behavior works for now because QEMU's IOMMU implementations are
|
||
globally scoped, and host bridges rely on the bypass_iommu property
|
||
to skip IOMMU translation when needed.
|
||
|
||
However, this model will break with the soon to be introduced
|
||
arm-smmuv3 device, which allows users to associate the IOMMU
|
||
with a specific PCIe root complex (e.g., the default pcie.0
|
||
or a pxb-pcie root complex).
|
||
|
||
For example, consider the following setup with multiple root
|
||
complexes:
|
||
|
||
-device arm-smmuv3,primary-bus=pcie.0,id=smmuv3.0 \
|
||
...
|
||
-device pxb-pcie,id=pcie.1,bus_nr=8,bus=pcie.0 \
|
||
-device pcie-root-port,id=pcie.port1,bus=pcie.1 \
|
||
-device virtio-net-pci,bus=pcie.port1
|
||
|
||
In Qemu, pxb-pcie acts as a special root complex whose parent is
|
||
effectively the default root complex(pcie.0). Hence, though pcie.1
|
||
has no associated SMMUv3 as per above, pci_device_get_iommu_bus_devfn()
|
||
will incorrectly return the IOMMU ops from pcie.0 due to the fallback
|
||
via parent_dev.
|
||
|
||
To fix this, introduce a new helper pci_setup_iommu_per_bus() that
|
||
explicitly sets the new iommu_per_bus field in the PCIBus structure.
|
||
This helper will be used in a subsequent patch that adds support for
|
||
the new arm-smmuv3 device.
|
||
|
||
Update pci_device_get_iommu_bus_devfn() to use iommu_per_bus when
|
||
determining the correct IOMMU ops, ensuring accurate behavior for
|
||
per-bus IOMMUs.
|
||
|
||
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
|
||
Reviewed-by: Eric Auger <eric.auger@redhat.com>
|
||
Tested-by: Nathan Chen <nathanc@nvidia.com>
|
||
Tested-by: Eric Auger <eric.auger@redhat.com>
|
||
Reviewed-by: Nicolin Chen <nicolinc@nvidia.com>
|
||
Tested-by: Nicolin Chen <nicolinc@nvidia.com>
|
||
Signed-off-by: Shameer Kolothum <shameerali.kolothum.thodi@huawei.com>
|
||
Signed-off-by: Shameer Kolothum <skolothumtho@nvidia.com>
|
||
Reviewed-by: Donald Dutile <ddutile@redhat.com>
|
||
Message-id: 20250829082543.7680-7-skolothumtho@nvidia.com
|
||
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
|
||
(cherry picked from commit 951bc76fb669eab96cc60e38a50097ad4435163e)
|
||
Signed-off-by: Eric Auger <eric.auger@redhat.com>
|
||
---
|
||
hw/pci/pci.c | 31 +++++++++++++++++++++++++++++++
|
||
include/hw/pci/pci.h | 2 ++
|
||
include/hw/pci/pci_bus.h | 1 +
|
||
3 files changed, 34 insertions(+)
|
||
|
||
diff --git a/hw/pci/pci.c b/hw/pci/pci.c
|
||
index c70b5ceeba..0012cc12e7 100644
|
||
--- a/hw/pci/pci.c
|
||
+++ b/hw/pci/pci.c
|
||
@@ -2909,6 +2909,19 @@ static void pci_device_get_iommu_bus_devfn(PCIDevice *dev,
|
||
}
|
||
}
|
||
|
||
+ /*
|
||
+ * When multiple PCI Express Root Buses are defined using pxb-pcie,
|
||
+ * the IOMMU configuration may be specific to each root bus. However,
|
||
+ * pxb-pcie acts as a special root complex whose parent is effectively
|
||
+ * the default root complex(pcie.0). Ensure that we retrieve the
|
||
+ * correct IOMMU ops(if any) in such cases.
|
||
+ */
|
||
+ if (pci_bus_is_express(iommu_bus) && pci_bus_is_root(iommu_bus)) {
|
||
+ if (parent_bus->iommu_per_bus) {
|
||
+ break;
|
||
+ }
|
||
+ }
|
||
+
|
||
iommu_bus = parent_bus;
|
||
}
|
||
|
||
@@ -3169,6 +3182,24 @@ void pci_setup_iommu(PCIBus *bus, const PCIIOMMUOps *ops, void *opaque)
|
||
bus->iommu_opaque = opaque;
|
||
}
|
||
|
||
+/*
|
||
+ * Similar to pci_setup_iommu(), but sets iommu_per_bus to true,
|
||
+ * indicating that the IOMMU is specific to this bus. This is used by
|
||
+ * IOMMU implementations that are tied to a specific PCIe root complex.
|
||
+ *
|
||
+ * In QEMU, pxb-pcie behaves as a special root complex whose parent is
|
||
+ * effectively the default root complex (pcie.0). The iommu_per_bus
|
||
+ * is checked in pci_device_get_iommu_bus_devfn() to ensure the correct
|
||
+ * IOMMU ops are returned, avoiding the use of the parent’s IOMMU when
|
||
+ * it's not appropriate.
|
||
+ */
|
||
+void pci_setup_iommu_per_bus(PCIBus *bus, const PCIIOMMUOps *ops,
|
||
+ void *opaque)
|
||
+{
|
||
+ pci_setup_iommu(bus, ops, opaque);
|
||
+ bus->iommu_per_bus = true;
|
||
+}
|
||
+
|
||
static void pci_dev_get_w64(PCIBus *b, PCIDevice *dev, void *opaque)
|
||
{
|
||
Range *range = opaque;
|
||
diff --git a/include/hw/pci/pci.h b/include/hw/pci/pci.h
|
||
index 6b7d3ac8a3..6bccb25ac2 100644
|
||
--- a/include/hw/pci/pci.h
|
||
+++ b/include/hw/pci/pci.h
|
||
@@ -773,6 +773,8 @@ int pci_iommu_unregister_iotlb_notifier(PCIDevice *dev, uint32_t pasid,
|
||
*/
|
||
void pci_setup_iommu(PCIBus *bus, const PCIIOMMUOps *ops, void *opaque);
|
||
|
||
+void pci_setup_iommu_per_bus(PCIBus *bus, const PCIIOMMUOps *ops, void *opaque);
|
||
+
|
||
pcibus_t pci_bar_address(PCIDevice *d,
|
||
int reg, uint8_t type, pcibus_t size);
|
||
|
||
diff --git a/include/hw/pci/pci_bus.h b/include/hw/pci/pci_bus.h
|
||
index 2261312546..c738446788 100644
|
||
--- a/include/hw/pci/pci_bus.h
|
||
+++ b/include/hw/pci/pci_bus.h
|
||
@@ -35,6 +35,7 @@ struct PCIBus {
|
||
enum PCIBusFlags flags;
|
||
const PCIIOMMUOps *iommu_ops;
|
||
void *iommu_opaque;
|
||
+ bool iommu_per_bus;
|
||
uint8_t devfn_min;
|
||
uint32_t slot_reserved_mask;
|
||
pci_set_irq_fn set_irq;
|
||
--
|
||
2.47.3
|
||
|