9 files changed, 155 insertions, 1 deletions

diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index 22152ed148a5..8f540d8abec5 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -1064,7 +1064,9 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
                 nomerge
                 forcesac
                 soft
-                pt      [x86, IA-64]
+                pt              [x86, IA-64]
+                group_mf        [x86, IA-64]
+
 
         io7=            [HW] IO7 for Marvel based alpha systems
                         See comment before marvel_specify_io7 in
diff --git a/arch/ia64/include/asm/iommu.h b/arch/ia64/include/asm/iommu.h
index 105c93b00b1b..b6a809fa2995 100644
--- a/arch/ia64/include/asm/iommu.h
+++ b/arch/ia64/include/asm/iommu.h
@@ -11,10 +11,12 @@ extern void no_iommu_init(void);
 extern int force_iommu, no_iommu;
 extern int iommu_pass_through;
 extern int iommu_detected;
+extern int iommu_group_mf;
 #else
 #define iommu_pass_through      (0)
 #define no_iommu                (1)
 #define iommu_detected          (0)
+#define iommu_group_mf          (0)
 #endif
 extern void iommu_dma_init(void);
 extern void machvec_init(const char *name);
diff --git a/arch/ia64/kernel/pci-dma.c b/arch/ia64/kernel/pci-dma.c
index c16162c70860..eb1175720050 100644
--- a/arch/ia64/kernel/pci-dma.c
+++ b/arch/ia64/kernel/pci-dma.c
@@ -33,6 +33,7 @@ int force_iommu __read_mostly;
 #endif
 
 int iommu_pass_through;
+int iommu_group_mf;
 
 /* Dummy device used for NULL arguments (normally ISA). Better would
    be probably a smaller DMA mask, but this is bug-to-bug compatible
diff --git a/arch/x86/include/asm/iommu.h b/arch/x86/include/asm/iommu.h
index 345c99cef152..dffc38ee6255 100644
--- a/arch/x86/include/asm/iommu.h
+++ b/arch/x86/include/asm/iommu.h
@@ -5,6 +5,7 @@ extern struct dma_map_ops nommu_dma_ops;
 extern int force_iommu, no_iommu;
 extern int iommu_detected;
 extern int iommu_pass_through;
+extern int iommu_group_mf;
 
 /* 10 seconds */
 #define DMAR_OPERATION_TIMEOUT ((cycles_t) tsc_khz*10*1000)
diff --git a/arch/x86/kernel/pci-dma.c b/arch/x86/kernel/pci-dma.c
index 80dc793b3f63..1c4d769e21ea 100644
--- a/arch/x86/kernel/pci-dma.c
+++ b/arch/x86/kernel/pci-dma.c
@@ -45,6 +45,15 @@ int iommu_detected __read_mostly = 0;
  */
 int iommu_pass_through __read_mostly;
 
+/*
+ * Group multi-function PCI devices into a single device-group for the
+ * iommu_device_group interface.  This tells the iommu driver to pretend
+ * it cannot distinguish between functions of a device, exposing only one
+ * group for the device.  Useful for disallowing use of individual PCI
+ * functions from userspace drivers.
+ */
+int iommu_group_mf __read_mostly;
+
 extern struct iommu_table_entry __iommu_table[], __iommu_table_end[];
 
 /* Dummy device used for NULL arguments (normally ISA). */
@@ -169,6 +178,8 @@ static __init int iommu_setup(char *p)
 #endif
                 if (!strncmp(p, "pt", 2))
                         iommu_pass_through = 1;
+                if (!strncmp(p, "group_mf", 8))
+                        iommu_group_mf = 1;
 
                 gart_parse_options(p);
 
diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
index edd291070b0b..cce1f03b8895 100644
--- a/drivers/iommu/amd_iommu.c
+++ b/drivers/iommu/amd_iommu.c
@@ -3188,6 +3188,26 @@ static int amd_iommu_domain_has_cap(struct iommu_domain *domain,
         return 0;
 }
 
+static int amd_iommu_device_group(struct device *dev, unsigned int *groupid)
+{
+        struct iommu_dev_data *dev_data = dev->archdata.iommu;
+        struct pci_dev *pdev = to_pci_dev(dev);
+        u16 devid;
+
+        if (!dev_data)
+                return -ENODEV;
+
+        if (pdev->is_virtfn || !iommu_group_mf)
+                devid = dev_data->devid;
+        else
+                devid = calc_devid(pdev->bus->number,
+                                   PCI_DEVFN(PCI_SLOT(pdev->devfn), 0));
+
+        *groupid = amd_iommu_alias_table[devid];
+
+        return 0;
+}
+
 static struct iommu_ops amd_iommu_ops = {
         .domain_init = amd_iommu_domain_init,
         .domain_destroy = amd_iommu_domain_destroy,
@@ -3197,6 +3217,7 @@ static struct iommu_ops amd_iommu_ops = {
         .unmap = amd_iommu_unmap,
         .iova_to_phys = amd_iommu_iova_to_phys,
         .domain_has_cap = amd_iommu_domain_has_cap,
+        .device_group = amd_iommu_device_group,
         .pgsize_bitmap  = AMD_IOMMU_PGSIZES,
 };
 
diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index aea72e11e166..77e3b917c8da 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -4080,6 +4080,54 @@ static int intel_iommu_domain_has_cap(struct iommu_domain *domain,
         return 0;
 }
 
+/*
+ * Group numbers are arbitrary.  Device with the same group number
+ * indicate the iommu cannot differentiate between them.  To avoid
+ * tracking used groups we just use the seg|bus|devfn of the lowest
+ * level we're able to differentiate devices
+ */
+static int intel_iommu_device_group(struct device *dev, unsigned int *groupid)
+{
+        struct pci_dev *pdev = to_pci_dev(dev);
+        struct pci_dev *bridge;
+        union {
+                struct {
+                        u8 devfn;
+                        u8 bus;
+                        u16 segment;
+                } pci;
+                u32 group;
+        } id;
+
+        if (iommu_no_mapping(dev))
+                return -ENODEV;
+
+        id.pci.segment = pci_domain_nr(pdev->bus);
+        id.pci.bus = pdev->bus->number;
+        id.pci.devfn = pdev->devfn;
+
+        if (!device_to_iommu(id.pci.segment, id.pci.bus, id.pci.devfn))
+                return -ENODEV;
+
+        bridge = pci_find_upstream_pcie_bridge(pdev);
+        if (bridge) {
+                if (pci_is_pcie(bridge)) {
+                        id.pci.bus = bridge->subordinate->number;
+                        id.pci.devfn = 0;
+                } else {
+                        id.pci.bus = bridge->bus->number;
+                        id.pci.devfn = bridge->devfn;
+                }
+        }
+
+        if (!pdev->is_virtfn && iommu_group_mf)
+                id.pci.devfn = PCI_DEVFN(PCI_SLOT(id.pci.devfn), 0);
+
+        *groupid = id.group;
+
+        return 0;
+}
+
 static struct iommu_ops intel_iommu_ops = {
         .domain_init    = intel_iommu_domain_init,
         .domain_destroy = intel_iommu_domain_destroy,
@@ -4089,6 +4137,7 @@ static struct iommu_ops intel_iommu_ops = {
         .unmap          = intel_iommu_unmap,
         .iova_to_phys   = intel_iommu_iova_to_phys,
         .domain_has_cap = intel_iommu_domain_has_cap,
+        .device_group   = intel_iommu_device_group,
         .pgsize_bitmap  = INTEL_IOMMU_PGSIZES,
 };
 
diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c
index 14d6f908196b..2198b2dbbcd3 100644
--- a/drivers/iommu/iommu.c
+++ b/drivers/iommu/iommu.c
@@ -27,8 +27,59 @@
 #include <linux/errno.h>
 #include <linux/iommu.h>
 
+static ssize_t show_iommu_group(struct device *dev,
+                                struct device_attribute *attr, char *buf)
+{
+        unsigned int groupid;
+
+        if (iommu_device_group(dev, &groupid))
+                return 0;
+
+        return sprintf(buf, "%u", groupid);
+}
+static DEVICE_ATTR(iommu_group, S_IRUGO, show_iommu_group, NULL);
+
+static int add_iommu_group(struct device *dev, void *data)
+{
+        unsigned int groupid;
+
+        if (iommu_device_group(dev, &groupid) == 0)
+                return device_create_file(dev, &dev_attr_iommu_group);
+
+        return 0;
+}
+
+static int remove_iommu_group(struct device *dev)
+{
+        unsigned int groupid;
+
+        if (iommu_device_group(dev, &groupid) == 0)
+                device_remove_file(dev, &dev_attr_iommu_group);
+
+        return 0;
+}
+
+static int iommu_device_notifier(struct notifier_block *nb,
+                                 unsigned long action, void *data)
+{
+        struct device *dev = data;
+
+        if (action == BUS_NOTIFY_ADD_DEVICE)
+                return add_iommu_group(dev, NULL);
+        else if (action == BUS_NOTIFY_DEL_DEVICE)
+                return remove_iommu_group(dev);
+
+        return 0;
+}
+
+static struct notifier_block iommu_device_nb = {
+        .notifier_call = iommu_device_notifier,
+};
+
 static void iommu_bus_init(struct bus_type *bus, struct iommu_ops *ops)
 {
+        bus_register_notifier(bus, &iommu_device_nb);
+        bus_for_each_dev(bus, NULL, NULL, add_iommu_group);
 }
 
 /**
@@ -281,3 +332,12 @@ size_t iommu_unmap(struct iommu_domain *domain, unsigned long iova, size_t size)
         return unmapped;
 }
 EXPORT_SYMBOL_GPL(iommu_unmap);
+
+int iommu_device_group(struct device *dev, unsigned int *groupid)
+{
+        if (iommu_present(dev->bus) && dev->bus->iommu_ops->device_group)
+                return dev->bus->iommu_ops->device_group(dev, groupid);
+
+        return -ENODEV;
+}
+EXPORT_SYMBOL_GPL(iommu_device_group);
diff --git a/include/linux/iommu.h b/include/linux/iommu.h
index cc26f89c4ee6..d937580417ba 100644
--- a/include/linux/iommu.h
+++ b/include/linux/iommu.h
@@ -74,6 +74,7 @@ struct iommu_ops {
                                     unsigned long iova);
         int (*domain_has_cap)(struct iommu_domain *domain,
                               unsigned long cap);
+        int (*device_group)(struct device *dev, unsigned int *groupid);
         unsigned long pgsize_bitmap;
 };
 
@@ -95,6 +96,7 @@ extern int iommu_domain_has_cap(struct iommu_domain *domain,
                                 unsigned long cap);
 extern void iommu_set_fault_handler(struct iommu_domain *domain,
                                         iommu_fault_handler_t handler);
+extern int iommu_device_group(struct device *dev, unsigned int *groupid);
 
 /**
  * report_iommu_fault() - report about an IOMMU fault to the IOMMU framework
@@ -193,6 +195,11 @@ static inline void iommu_set_fault_handler(struct iommu_domain *domain,
 {
 }
 
+static inline int iommu_device_group(struct device *dev, unsigned int *groupid)
+{
+        return -ENODEV;
+}
+
 #endif /* CONFIG_IOMMU_API */
 
 #endif /* __LINUX_IOMMU_H */