[PATCH RFC 3/4] iommu/arm-smmu-v3: Group aliasing devices into the same IOMMU group

[Peng Fan (OSS)]

From: Peng Fan <peng.fan@xxxxxxx>

arm_smmu_device_group() previously rejected SID aliasing with a comment
saying it was impractical.  Now that the XArray makes SID lookup O(1),
detect aliasing at group-assignment time and place the new device into
the same IOMMU group as the master that already owns the SID.

This is a prerequisite for shared-SID support: devices sharing a SID
must share a single IOMMU domain and therefore a single cd_table,
because the STE can only point to one cd_table at a time.

arm_smmu_device_group() is called before arm_smmu_insert_master() adds
the current master's streams to the xarray, so any xarray hit here
belongs to a different, already-probed master.  streams_mutex is held
to ensure the xarray is stable and the returned stream object is not
freed concurrently.

If a device has multiple SIDs that land in different existing groups, a
warning is emitted. The IOMMU core has no group-merge API, so this
cannot be fixed up and DMA isolation may be compromised.

Assisted-by: Claude:claude-opus-4-6
Signed-off-by: Peng Fan <peng.fan@xxxxxxx>
---
 drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 61 +++++++++++++++++++++++++----
 1 file changed, 53 insertions(+), 8 deletions(-)

diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
index f53e1871426a5..bb3ee25d10d6e 100644
--- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
+++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
@@ -4365,19 +4365,64 @@ static int arm_smmu_set_dirty_tracking(struct iommu_domain *domain,
 
 static struct iommu_group *arm_smmu_device_group(struct device *dev)
 {
-	struct iommu_group *group;
+	struct arm_smmu_master *master = dev_iommu_priv_get(dev);
+	struct arm_smmu_device *smmu = master->smmu;
+	struct iommu_fwspec *fwspec = dev_iommu_fwspec_get(dev);
+	struct iommu_group *group = NULL;
+	int i;
 
 	/*
-	 * We don't support devices sharing stream IDs other than PCI RID
-	 * aliases, since the necessary ID-to-device lookup becomes rather
-	 * impractical given a potential sparse 32-bit stream ID space.
+	 * If any of this device's SIDs are already owned by another master,
+	 * place this device in the same IOMMU group as that master.  This
+	 * ensures that aliasing devices share a single domain and therefore
+	 * a single cd_table, which is required because the STE can only
+	 * point to one cd_table at a time.
+	 *
+	 * arm_smmu_device_group() is called before arm_smmu_insert_master()
+	 * adds the current master's streams to the xarray, so any hit here
+	 * belongs to a different, already-probed master.
+	 *
+	 * streams_mutex is held to ensure the xarray is stable and the
+	 * returned stream object is not freed concurrently.
 	 */
+	mutex_lock(&smmu->streams_mutex);
+	for (i = 0; i < fwspec->num_ids; i++) {
+		struct arm_smmu_stream *stream =
+			xa_load(&smmu->streams, fwspec->ids[i]);
+		struct iommu_group *existing;
+
+		if (!stream)
+			continue;
+
+		existing = iommu_group_get(stream->master->dev);
+		if (!group) {
+			group = existing;
+		} else if (group != existing) {
+			/*
+			 * This device has SIDs in two different groups.
+			 * The IOMMU core has no group-merge API, so we
+			 * cannot fix this up.  Warn and keep the first
+			 * group — the mismatched SID will still be
+			 * inserted into the XArray and shared, but DMA
+			 * isolation is compromised.
+			 */
+			dev_warn(dev,
+				 "SID 0x%x already in a different IOMMU group than SID 0x%x, expect broken isolation\n",
+				 fwspec->ids[i], fwspec->ids[0]);
+			iommu_group_put(existing);
+		} else {
+			iommu_group_put(existing);
+		}
+	}
+	mutex_unlock(&smmu->streams_mutex);
+
+	if (group)
+		return group;
+
 	if (dev_is_pci(dev))
-		group = pci_device_group(dev);
-	else
-		group = generic_device_group(dev);
+		return pci_device_group(dev);
 
-	return group;
+	return generic_device_group(dev);
 }
 
 static int arm_smmu_of_xlate(struct device *dev,

-- 
2.34.1