Commit 43cfbdda authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd 

Pull iommufd updates from Jason Gunthorpe:
 "Several fixes:

   - Add missing static const

   - Correct type 1 emulation for VFIO_CHECK_EXTENSION when no-iommu is
     turned on

   - Fix selftest memory leak and syzkaller splat

   - Fix missed -EFAULT in fault reporting write() fops

   - Fix a race where map/unmap with the internal IOVA allocator can
     unmap things it should not"

* tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd:
  iommufd: Fix a race with concurrent allocation and unmap
  iommufd/selftest: Remove MOCK_IOMMUPT_AMDV1 format
  iommufd: Fix return value of iommufd_fault_fops_write()
  iommufd: update outdated comment for renamed iommufd_hw_pagetable_alloc()
  iommufd/selftest: Fix page leaks in mock_viommu_{init,destroy}
  iommufd: vfio compatibility extension check for noiommu mode
  iommufd: Constify struct dma_buf_attach_ops
parents 87fe97a1 8602018b

drivers/iommu/iommufd/device.c

+1 −1
Original line number Diff line number Diff line
@@ -866,7 +866,7 @@ iommufd_device_auto_get_domain(struct iommufd_device *idev, ioasid_t pasid, 
{

	/*

	 * iommufd_hw_pagetable_attach() is called by

	 * iommufd_hw_pagetable_alloc() in immediate attachment mode, same as

	 * iommufd_hwpt_paging_alloc() in immediate attachment mode, same as

	 * iommufd_device_do_attach(). So if we are in this mode then we prefer

	 * to use the immediate_attach path as it supports drivers that can't

	 * directly allocate a domain.

drivers/iommu/iommufd/eventq.c

+3 −2
Original line number Diff line number Diff line
@@ -187,9 +187,10 @@ static ssize_t iommufd_fault_fops_write(struct file *filep, const char __user *b 


	mutex_lock(&fault->mutex);

	while (count > done) {

		rc = copy_from_user(&response, buf + done, response_size);

		if (rc)

		if (copy_from_user(&response, buf + done, response_size)) {

			rc = -EFAULT;

			break;

		}



		static_assert((int)IOMMUFD_PAGE_RESP_SUCCESS ==

			      (int)IOMMU_PAGE_RESP_SUCCESS);

drivers/iommu/iommufd/io_pagetable.c

+10 −0
Original line number Diff line number Diff line
@@ -814,6 +814,16 @@ static int iopt_unmap_iova_range(struct io_pagetable *iopt, unsigned long start, 
		unmapped_bytes += area_last - area_first + 1;



		down_write(&iopt->iova_rwsem);



		/*

		 * After releasing the iova_rwsem concurrent allocation could

		 * place new areas at IOVAs we have already unmapped. Keep

		 * moving the start of the search forward to ignore the area

		 * already unmapped.

		 */

		if (area_last >= last)

			break;

		start = area_last + 1;

	}



out_unlock_iova:

drivers/iommu/iommufd/iommufd_test.h

+0 −1
Original line number Diff line number Diff line
@@ -36,7 +36,6 @@ enum { 
enum {

	MOCK_IOMMUPT_DEFAULT = 0,

	MOCK_IOMMUPT_HUGE,

	MOCK_IOMMUPT_AMDV1,

};



/* These values are true for MOCK_IOMMUPT_DEFAULT */

drivers/iommu/iommufd/pages.c

+1 −1
Original line number Diff line number Diff line
@@ -1450,7 +1450,7 @@ static void iopt_revoke_notify(struct dma_buf_attachment *attach) 
	pages->dmabuf.phys.len = 0;

}



static struct dma_buf_attach_ops iopt_dmabuf_attach_revoke_ops = {

static const struct dma_buf_attach_ops iopt_dmabuf_attach_revoke_ops = {

	.allow_peer2peer = true,

	.invalidate_mappings = iopt_revoke_notify,

};