Message ID | d29334e44c0e6489629dbe13c969c47d4285a877.1694693889.git.robin.murphy@arm.com |
---|---|
State | New |
Headers |
Return-Path: <linux-kernel-owner@vger.kernel.org> Delivered-To: ouuuleilei@gmail.com Received: by 2002:a05:612c:172:b0:3f2:4152:657d with SMTP id h50csp1189924vqi; Fri, 15 Sep 2023 10:00:37 -0700 (PDT) X-Google-Smtp-Source: AGHT+IFJSRTYBVZ42FzhTXR6O8XoBO9TvQEjm/RviIV1/YBIgOhX5r8WT+57vBrG30jDUln9CFjE X-Received: by 2002:aa7:88c8:0:b0:690:15c7:60d8 with SMTP id k8-20020aa788c8000000b0069015c760d8mr2953528pff.22.1694797236850; Fri, 15 Sep 2023 10:00:36 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1694797236; cv=none; d=google.com; s=arc-20160816; b=pRa4hz1MB92YK0J3LXCXwGtx4IFwNcuuD5+eR1fEWPn6LVMuZNQ6Q0LEEM16FrSQlm vo9FdqLrKoIqznuNQ9YJaCI94kkZ+wJlgBW0X2PEHYRP1E/mjN4EQUyd2oS4NRjBptVJ wwUC800xeY4kR/0eFPb0clsKyGyXupbyLBP0d6xqXlO8tGUhHmP4Q4gXqQVs6OmUpA9n QhuV5tZe2yQenWR0JZodFJ5F88dVM2ocOcCqDwiqn72AFclYUWeJk8FnjqeItA+wFKuj QXjdgwfraLC27W0SmkJ0LCx2/k7X6M3wb4M7pPHioeuC5l6h7UG9miecP/Eq6Ln5qWo/ iCNw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from; bh=8BokLdrBy30c8cv3LeR8AkqOmVCn0Dz/CNTR7bVKvFs=; fh=3SO4sBNpOFNxfB4XNpCUWqe4lDXSOQ4O5f1XEPxUZRQ=; b=ze4rCAx5kqiVWH9mjGgeptDTm7YuxlUubldf8OiVkVxz8zuC0ZIZTxEj+4L67C1nKf xwJfYLUagi7AtELT17RtIk+4KKOuh76LDT4qTghAn8Z1A2rIiQAZkq5ZNqFFwytV+XrV MFZpBeRea3TbgkPJVD8ztfY4hTiL7DdXSU4syPqyrHjEzOSGM3D4b88nRYco6Pcmfb3Y Ndpj1/NYeW0mTkO2C+ju2x8zuWkS25d4LZEd+MVyJB1wJuaD8rtfLhdZOsiv6PTHaQ4q GEvKMQjGzirrB3uAHNU6BN+jg6TB5tise68601By+4VVGuHjw6e42gii1Eo4DSr0+KxY /OtQ== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:3 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=arm.com Received: from lipwig.vger.email (lipwig.vger.email. [2620:137:e000::3:3]) by mx.google.com with ESMTPS id cr7-20020a056a000f0700b0068e0fcf8c28si3581611pfb.336.2023.09.15.10.00.21 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 15 Sep 2023 10:00:36 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:3 as permitted sender) client-ip=2620:137:e000::3:3; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:3 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=arm.com Received: from out1.vger.email (depot.vger.email [IPv6:2620:137:e000::3:0]) by lipwig.vger.email (Postfix) with ESMTP id 75EA182990E6; Fri, 15 Sep 2023 09:59:19 -0700 (PDT) X-Virus-Status: Clean X-Virus-Scanned: clamav-milter 0.103.10 at lipwig.vger.email Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235229AbjIOQ6p (ORCPT <rfc822;ruipengqi7@gmail.com> + 30 others); Fri, 15 Sep 2023 12:58:45 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37966 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234636AbjIOQ6d (ORCPT <rfc822;linux-kernel@vger.kernel.org>); Fri, 15 Sep 2023 12:58:33 -0400 Received: from foss.arm.com (foss.arm.com [217.140.110.172]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id 4B25319BC for <linux-kernel@vger.kernel.org>; Fri, 15 Sep 2023 09:58:28 -0700 (PDT) Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 4CD391FB; Fri, 15 Sep 2023 09:59:05 -0700 (PDT) Received: from e121345-lin.cambridge.arm.com (e121345-lin.cambridge.arm.com [10.1.196.40]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPA id F037E3F5A1; Fri, 15 Sep 2023 09:58:26 -0700 (PDT) From: Robin Murphy <robin.murphy@arm.com> To: joro@8bytes.org, will@kernel.org Cc: iommu@lists.linux.dev, linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org, jgg@nvidia.com, baolu.lu@linux.intel.com Subject: [PATCH v3 3/7] iommu: Validate that devices match domains Date: Fri, 15 Sep 2023 17:58:07 +0100 Message-Id: <d29334e44c0e6489629dbe13c969c47d4285a877.1694693889.git.robin.murphy@arm.com> X-Mailer: git-send-email 2.39.2.101.g768bb238c484.dirty In-Reply-To: <cover.1694693889.git.robin.murphy@arm.com> References: <cover.1694693889.git.robin.murphy@arm.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Spam-Status: No, score=-0.8 required=5.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lipwig.vger.email Precedence: bulk List-ID: <linux-kernel.vger.kernel.org> X-Mailing-List: linux-kernel@vger.kernel.org X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (lipwig.vger.email [0.0.0.0]); Fri, 15 Sep 2023 09:59:19 -0700 (PDT) X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1777123707509116972 X-GMAIL-MSGID: 1777123707509116972 |
Series |
Iommu: Retire bus ops
|
|
Commit Message
Robin Murphy
Sept. 15, 2023, 4:58 p.m. UTC
Before we can allow drivers to coexist, we need to make sure that one driver's domain ops can't misinterpret another driver's dev_iommu_priv data. To that end, add a token to the domain so we can remember how it was allocated - for now this may as well be the device ops, since they still correlate 1:1 with drivers. We can trust ourselves for internal default domain attachment, so add the check where it covers both the external attach interfaces. Reviewed-by: Lu Baolu <baolu.lu@linux.intel.com> Reviewed-by: Jason Gunthorpe <jgg@nvidia.com> Signed-off-by: Robin Murphy <robin.murphy@arm.com> --- drivers/iommu/iommu.c | 13 +++++++++---- include/linux/iommu.h | 1 + 2 files changed, 10 insertions(+), 4 deletions(-)
Comments
On 9/16/23 12:58 AM, Robin Murphy wrote: > Before we can allow drivers to coexist, we need to make sure that one > driver's domain ops can't misinterpret another driver's dev_iommu_priv > data. To that end, add a token to the domain so we can remember how it > was allocated - for now this may as well be the device ops, since they > still correlate 1:1 with drivers. We can trust ourselves for internal > default domain attachment, so add the check where it covers both the > external attach interfaces. > > Reviewed-by: Lu Baolu <baolu.lu@linux.intel.com> > Reviewed-by: Jason Gunthorpe <jgg@nvidia.com> > Signed-off-by: Robin Murphy <robin.murphy@arm.com> > --- > drivers/iommu/iommu.c | 13 +++++++++---- > include/linux/iommu.h | 1 + > 2 files changed, 10 insertions(+), 4 deletions(-) > > diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c > index 2f29ee9dea64..f4cc91227b22 100644 > --- a/drivers/iommu/iommu.c > +++ b/drivers/iommu/iommu.c > @@ -2000,26 +2000,28 @@ EXPORT_SYMBOL_GPL(iommu_set_fault_handler); > static struct iommu_domain *__iommu_domain_alloc(const struct bus_type *bus, > unsigned type) > { > + const struct iommu_ops *ops = bus ? bus->iommu_ops : NULL; > struct iommu_domain *domain; > unsigned int alloc_type = type & IOMMU_DOMAIN_ALLOC_FLAGS; > > - if (bus == NULL || bus->iommu_ops == NULL) > + if (!ops) > return NULL; > > - domain = bus->iommu_ops->domain_alloc(alloc_type); > + domain = ops->domain_alloc(alloc_type); > if (!domain) > return NULL; > > domain->type = type; > + domain->owner = ops; > /* > * If not already set, assume all sizes by default; the driver > * may override this later > */ > if (!domain->pgsize_bitmap) > - domain->pgsize_bitmap = bus->iommu_ops->pgsize_bitmap; > + domain->pgsize_bitmap = ops->pgsize_bitmap; > > if (!domain->ops) > - domain->ops = bus->iommu_ops->default_domain_ops; > + domain->ops = ops->default_domain_ops; > > if (iommu_is_dma_domain(domain) && iommu_get_dma_cookie(domain)) { > iommu_domain_free(domain); > @@ -2176,6 +2178,9 @@ static int __iommu_attach_group(struct iommu_domain *domain, > group->domain != group->blocking_domain) > return -EBUSY; > > + if (dev_iommu_ops(iommu_group_first_dev(group)) != domain->owner) > + return -EINVAL; Should we apply this check in iommu_attach_device_pasid()? diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c index 3bfc56df4f78..43acf1b8ed56 100644 --- a/drivers/iommu/iommu.c +++ b/drivers/iommu/iommu.c @@ -3414,6 +3414,9 @@ int iommu_attach_device_pasid(struct iommu_domain *domain, if (!group) return -ENODEV; + if (dev_iommu_ops(dev) != domain->owner) + return -EINVAL; + mutex_lock(&group->mutex); curr = xa_cmpxchg(&group->pasid_array, pasid, NULL, domain, GFP_KERNEL); if (curr) { > + > return __iommu_group_set_domain(group, domain); > } > > diff --git a/include/linux/iommu.h b/include/linux/iommu.h > index a249e10c8e9f..75ffcac199e3 100644 > --- a/include/linux/iommu.h > +++ b/include/linux/iommu.h > @@ -95,6 +95,7 @@ struct iommu_domain_geometry { > struct iommu_domain { > unsigned type; > const struct iommu_domain_ops *ops; > + const struct iommu_ops *owner; /* Whose domain_alloc we came from */ > unsigned long pgsize_bitmap; /* Bitmap of page sizes in use */ > struct iommu_domain_geometry geometry; > struct iommu_dma_cookie *iova_cookie; Best regards, baolu
On 2023-09-18 06:49, Baolu Lu wrote: > On 9/16/23 12:58 AM, Robin Murphy wrote: >> Before we can allow drivers to coexist, we need to make sure that one >> driver's domain ops can't misinterpret another driver's dev_iommu_priv >> data. To that end, add a token to the domain so we can remember how it >> was allocated - for now this may as well be the device ops, since they >> still correlate 1:1 with drivers. We can trust ourselves for internal >> default domain attachment, so add the check where it covers both the >> external attach interfaces. >> >> Reviewed-by: Lu Baolu <baolu.lu@linux.intel.com> >> Reviewed-by: Jason Gunthorpe <jgg@nvidia.com> >> Signed-off-by: Robin Murphy <robin.murphy@arm.com> >> --- >> drivers/iommu/iommu.c | 13 +++++++++---- >> include/linux/iommu.h | 1 + >> 2 files changed, 10 insertions(+), 4 deletions(-) >> >> diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c >> index 2f29ee9dea64..f4cc91227b22 100644 >> --- a/drivers/iommu/iommu.c >> +++ b/drivers/iommu/iommu.c >> @@ -2000,26 +2000,28 @@ EXPORT_SYMBOL_GPL(iommu_set_fault_handler); >> static struct iommu_domain *__iommu_domain_alloc(const struct >> bus_type *bus, >> unsigned type) >> { >> + const struct iommu_ops *ops = bus ? bus->iommu_ops : NULL; >> struct iommu_domain *domain; >> unsigned int alloc_type = type & IOMMU_DOMAIN_ALLOC_FLAGS; >> - if (bus == NULL || bus->iommu_ops == NULL) >> + if (!ops) >> return NULL; >> - domain = bus->iommu_ops->domain_alloc(alloc_type); >> + domain = ops->domain_alloc(alloc_type); >> if (!domain) >> return NULL; >> domain->type = type; >> + domain->owner = ops; >> /* >> * If not already set, assume all sizes by default; the driver >> * may override this later >> */ >> if (!domain->pgsize_bitmap) >> - domain->pgsize_bitmap = bus->iommu_ops->pgsize_bitmap; >> + domain->pgsize_bitmap = ops->pgsize_bitmap; >> if (!domain->ops) >> - domain->ops = bus->iommu_ops->default_domain_ops; >> + domain->ops = ops->default_domain_ops; >> if (iommu_is_dma_domain(domain) && iommu_get_dma_cookie(domain)) { >> iommu_domain_free(domain); >> @@ -2176,6 +2178,9 @@ static int __iommu_attach_group(struct >> iommu_domain *domain, >> group->domain != group->blocking_domain) >> return -EBUSY; >> + if (dev_iommu_ops(iommu_group_first_dev(group)) != domain->owner) >> + return -EINVAL; > > Should we apply this check in iommu_attach_device_pasid()? Oh, probably - I don't think I've really noticed that we've grown yet another attach interface since I started this. Looks like current users are passing appropriate domains by construction, but I concur that that path wants covering as well for completeness. Thanks, Robin. > diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c > index 3bfc56df4f78..43acf1b8ed56 100644 > --- a/drivers/iommu/iommu.c > +++ b/drivers/iommu/iommu.c > @@ -3414,6 +3414,9 @@ int iommu_attach_device_pasid(struct iommu_domain > *domain, > if (!group) > return -ENODEV; > > + if (dev_iommu_ops(dev) != domain->owner) > + return -EINVAL; > + > mutex_lock(&group->mutex); > curr = xa_cmpxchg(&group->pasid_array, pasid, NULL, domain, > GFP_KERNEL); > if (curr) { > >> + >> return __iommu_group_set_domain(group, domain); >> } >> diff --git a/include/linux/iommu.h b/include/linux/iommu.h >> index a249e10c8e9f..75ffcac199e3 100644 >> --- a/include/linux/iommu.h >> +++ b/include/linux/iommu.h >> @@ -95,6 +95,7 @@ struct iommu_domain_geometry { >> struct iommu_domain { >> unsigned type; >> const struct iommu_domain_ops *ops; >> + const struct iommu_ops *owner; /* Whose domain_alloc we came from */ >> unsigned long pgsize_bitmap; /* Bitmap of page sizes in use */ >> struct iommu_domain_geometry geometry; >> struct iommu_dma_cookie *iova_cookie; > > Best regards, > baolu
diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c index 2f29ee9dea64..f4cc91227b22 100644 --- a/drivers/iommu/iommu.c +++ b/drivers/iommu/iommu.c @@ -2000,26 +2000,28 @@ EXPORT_SYMBOL_GPL(iommu_set_fault_handler); static struct iommu_domain *__iommu_domain_alloc(const struct bus_type *bus, unsigned type) { + const struct iommu_ops *ops = bus ? bus->iommu_ops : NULL; struct iommu_domain *domain; unsigned int alloc_type = type & IOMMU_DOMAIN_ALLOC_FLAGS; - if (bus == NULL || bus->iommu_ops == NULL) + if (!ops) return NULL; - domain = bus->iommu_ops->domain_alloc(alloc_type); + domain = ops->domain_alloc(alloc_type); if (!domain) return NULL; domain->type = type; + domain->owner = ops; /* * If not already set, assume all sizes by default; the driver * may override this later */ if (!domain->pgsize_bitmap) - domain->pgsize_bitmap = bus->iommu_ops->pgsize_bitmap; + domain->pgsize_bitmap = ops->pgsize_bitmap; if (!domain->ops) - domain->ops = bus->iommu_ops->default_domain_ops; + domain->ops = ops->default_domain_ops; if (iommu_is_dma_domain(domain) && iommu_get_dma_cookie(domain)) { iommu_domain_free(domain); @@ -2176,6 +2178,9 @@ static int __iommu_attach_group(struct iommu_domain *domain, group->domain != group->blocking_domain) return -EBUSY; + if (dev_iommu_ops(iommu_group_first_dev(group)) != domain->owner) + return -EINVAL; + return __iommu_group_set_domain(group, domain); } diff --git a/include/linux/iommu.h b/include/linux/iommu.h index a249e10c8e9f..75ffcac199e3 100644 --- a/include/linux/iommu.h +++ b/include/linux/iommu.h @@ -95,6 +95,7 @@ struct iommu_domain_geometry { struct iommu_domain { unsigned type; const struct iommu_domain_ops *ops; + const struct iommu_ops *owner; /* Whose domain_alloc we came from */ unsigned long pgsize_bitmap; /* Bitmap of page sizes in use */ struct iommu_domain_geometry geometry; struct iommu_dma_cookie *iova_cookie;