Commit a9c362db authored by Robin Murphy's avatar Robin Murphy Committed by Joerg Roedel
Browse files

iommu: Validate that devices match domains 



Before we can allow drivers to coexist, we need to make sure that one
driver's domain ops can't misinterpret another driver's dev_iommu_priv
data. To that end, add a token to the domain so we can remember how it
was allocated - for now this may as well be the device ops, since they
still correlate 1:1 with drivers. We can trust ourselves for internal
default domain attachment, so add checks to cover all the public attach
interfaces.

Reviewed-by: default avatarLu Baolu <baolu.lu@linux.intel.com>
Reviewed-by: default avatarJason Gunthorpe <jgg@nvidia.com>
Reviewed-by: default avatarJerry Snitselaar <jsnitsel@redhat.com>
Signed-off-by: default avatarRobin Murphy <robin.murphy@arm.com>
Link: https://lore.kernel.org/r/097c6f30480e4efe12195d00ba0e84ea4837fb4c.1700589539.git.robin.murphy@arm.com


Signed-off-by: default avatarJoerg Roedel <jroedel@suse.de>
parent 1d8d43bb

drivers/iommu/iommu.c

+10 −0
Original line number Diff line number Diff line
@@ -2117,6 +2117,7 @@ static struct iommu_domain *__iommu_domain_alloc(const struct iommu_ops *ops, 
		return NULL;



	domain->type = type;

	domain->owner = ops;

	/*

	 * If not already set, assume all sizes by default; the driver

	 * may override this later
@@ -2282,10 +2283,16 @@ struct iommu_domain *iommu_get_dma_domain(struct device *dev) 
static int __iommu_attach_group(struct iommu_domain *domain,

				struct iommu_group *group)

{

	struct device *dev;



	if (group->domain && group->domain != group->default_domain &&

	    group->domain != group->blocking_domain)

		return -EBUSY;



	dev = iommu_group_first_dev(group);

	if (!dev_has_iommu(dev) || dev_iommu_ops(dev) != domain->owner)

		return -EINVAL;



	return __iommu_group_set_domain(group, domain);

}
@@ -3477,6 +3484,9 @@ int iommu_attach_device_pasid(struct iommu_domain *domain, 
	if (!group)

		return -ENODEV;



	if (!dev_has_iommu(dev) || dev_iommu_ops(dev) != domain->owner)

		return -EINVAL;



	mutex_lock(&group->mutex);

	curr = xa_cmpxchg(&group->pasid_array, pasid, NULL, domain, GFP_KERNEL);

	if (curr) {

drivers/iommu/iommufd/hw_pagetable.c

+2 −0
Original line number Diff line number Diff line
@@ -135,6 +135,7 @@ iommufd_hwpt_paging_alloc(struct iommufd_ctx *ictx, struct iommufd_ioas *ioas, 
			hwpt->domain = NULL;

			goto out_abort;

		}

		hwpt->domain->owner = ops;

	} else {

		hwpt->domain = iommu_domain_alloc(idev->dev->bus);

		if (!hwpt->domain) {
@@ -233,6 +234,7 @@ iommufd_hwpt_nested_alloc(struct iommufd_ctx *ictx, 
		hwpt->domain = NULL;

		goto out_abort;

	}

	hwpt->domain->owner = ops;



	if (WARN_ON_ONCE(hwpt->domain->type != IOMMU_DOMAIN_NESTED)) {

		rc = -EINVAL;

include/linux/iommu.h

+1 −1
Original line number Diff line number Diff line
@@ -106,7 +106,7 @@ struct iommu_domain { 
	unsigned type;

	const struct iommu_domain_ops *ops;

	const struct iommu_dirty_ops *dirty_ops;



	const struct iommu_ops *owner; /* Whose domain_alloc we came from */

	unsigned long pgsize_bitmap;	/* Bitmap of page sizes in use */

	struct iommu_domain_geometry geometry;

	struct iommu_dma_cookie *iova_cookie;