Commit aa44198a authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd 

Pull iommufd updates from Jason Gunthorpe:
 "No major functionality this cycle:

   - iommufd part of the domain_alloc_paging_flags() conversion

   - Move IOMMU_HWPT_FAULT_ID_VALID processing out of drivers

   - Increase a timeout waiting for other threads to drop transient
     refcounts that syzkaller was hitting

   - Fix a UBSAN hit in iova_bitmap due to shift out of bounds

   - Add missing cleanup of fault events during FD shutdown, fixing a
     memory leak

   - Improve the fault delivery flow to have a smaller locking critical
     region that does not include copy_to_user()

   - Fix 32 bit ABI breakage due to missed implicit padding, and fix the
     stack memory leakage"

* tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd:
  iommufd: Fix struct iommu_hwpt_pgfault init and padding
  iommufd/fault: Use a separate spinlock to protect fault->deliver list
  iommufd/fault: Destroy response and mutex in iommufd_fault_destroy()
  iommufd: Keep OBJ/IOCTL lists in an alphabetical order
  iommufd/iova_bitmap: Fix shift-out-of-bounds in iova_bitmap_offset_to_index()
  iommu: iommufd: fix WARNING in iommufd_device_unbind
  iommufd: Deal with IOMMU_HWPT_FAULT_ID_VALID in iommufd core
  iommufd/selftest: Remove domain_alloc_paging()
parents 47d65738 e721f619

drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-iommufd.c

+1 −7
Original line number Diff line number Diff line
@@ -178,18 +178,12 @@ arm_vsmmu_alloc_domain_nested(struct iommufd_viommu *viommu, u32 flags, 
			      const struct iommu_user_data *user_data)

{

	struct arm_vsmmu *vsmmu = container_of(viommu, struct arm_vsmmu, core);

	const u32 SUPPORTED_FLAGS = IOMMU_HWPT_FAULT_ID_VALID;

	struct arm_smmu_nested_domain *nested_domain;

	struct iommu_hwpt_arm_smmuv3 arg;

	bool enable_ats = false;

	int ret;



	/*

	 * Faults delivered to the nested domain are faults that originated by

	 * the S1 in the domain. The core code will match all PASIDs when

	 * delivering the fault due to user_pasid_table

	 */

	if (flags & ~SUPPORTED_FLAGS)

	if (flags)

		return ERR_PTR(-EOPNOTSUPP);



	ret = iommu_copy_struct_from_user(&arg, user_data,

drivers/iommu/intel/iommu.c

+1 −2
Original line number Diff line number Diff line
@@ -3338,8 +3338,7 @@ intel_iommu_domain_alloc_paging_flags(struct device *dev, u32 flags, 
	bool first_stage;



	if (flags &

	    (~(IOMMU_HWPT_ALLOC_NEST_PARENT | IOMMU_HWPT_ALLOC_DIRTY_TRACKING

	       | IOMMU_HWPT_FAULT_ID_VALID)))

	    (~(IOMMU_HWPT_ALLOC_NEST_PARENT | IOMMU_HWPT_ALLOC_DIRTY_TRACKING)))

		return ERR_PTR(-EOPNOTSUPP);

	if (nested_parent && !nested_supported(iommu))

		return ERR_PTR(-EOPNOTSUPP);

drivers/iommu/iommufd/fault.c

+31 −13
Original line number Diff line number Diff line
@@ -103,15 +103,23 @@ static void iommufd_auto_response_faults(struct iommufd_hw_pagetable *hwpt, 
{

	struct iommufd_fault *fault = hwpt->fault;

	struct iopf_group *group, *next;

	struct list_head free_list;

	unsigned long index;



	if (!fault)

		return;

	INIT_LIST_HEAD(&free_list);



	mutex_lock(&fault->mutex);

	spin_lock(&fault->lock);

	list_for_each_entry_safe(group, next, &fault->deliver, node) {

		if (group->attach_handle != &handle->handle)

			continue;

		list_move(&group->node, &free_list);

	}

	spin_unlock(&fault->lock);



	list_for_each_entry_safe(group, next, &free_list, node) {

		list_del(&group->node);

		iopf_group_response(group, IOMMU_PAGE_RESP_INVALID);

		iopf_free_group(group);
@@ -213,6 +221,7 @@ void iommufd_fault_destroy(struct iommufd_object *obj) 
{

	struct iommufd_fault *fault = container_of(obj, struct iommufd_fault, obj);

	struct iopf_group *group, *next;

	unsigned long index;



	/*

	 * The iommufd object's reference count is zero at this point.
@@ -225,6 +234,13 @@ void iommufd_fault_destroy(struct iommufd_object *obj) 
		iopf_group_response(group, IOMMU_PAGE_RESP_INVALID);

		iopf_free_group(group);

	}

	xa_for_each(&fault->response, index, group) {

		xa_erase(&fault->response, index);

		iopf_group_response(group, IOMMU_PAGE_RESP_INVALID);

		iopf_free_group(group);

	}

	xa_destroy(&fault->response);

	mutex_destroy(&fault->mutex);

}



static void iommufd_compose_fault_message(struct iommu_fault *fault,
@@ -247,7 +263,7 @@ static ssize_t iommufd_fault_fops_read(struct file *filep, char __user *buf, 
{

	size_t fault_size = sizeof(struct iommu_hwpt_pgfault);

	struct iommufd_fault *fault = filep->private_data;

	struct iommu_hwpt_pgfault data;

	struct iommu_hwpt_pgfault data = {};

	struct iommufd_device *idev;

	struct iopf_group *group;

	struct iopf_fault *iopf;
@@ -258,17 +274,19 @@ static ssize_t iommufd_fault_fops_read(struct file *filep, char __user *buf, 
		return -ESPIPE;



	mutex_lock(&fault->mutex);

	while (!list_empty(&fault->deliver) && count > done) {

		group = list_first_entry(&fault->deliver,

					 struct iopf_group, node);



		if (group->fault_count * fault_size > count - done)

	while ((group = iommufd_fault_deliver_fetch(fault))) {

		if (done >= count ||

		    group->fault_count * fault_size > count - done) {

			iommufd_fault_deliver_restore(fault, group);

			break;

		}



		rc = xa_alloc(&fault->response, &group->cookie, group,

			      xa_limit_32b, GFP_KERNEL);

		if (rc)

		if (rc) {

			iommufd_fault_deliver_restore(fault, group);

			break;

		}



		idev = to_iommufd_handle(group->attach_handle)->idev;

		list_for_each_entry(iopf, &group->faults, list) {
@@ -277,13 +295,12 @@ static ssize_t iommufd_fault_fops_read(struct file *filep, char __user *buf, 
						      group->cookie);

			if (copy_to_user(buf + done, &data, fault_size)) {

				xa_erase(&fault->response, group->cookie);

				iommufd_fault_deliver_restore(fault, group);

				rc = -EFAULT;

				break;

			}

			done += fault_size;

		}



		list_del(&group->node);

	}

	mutex_unlock(&fault->mutex);
@@ -341,10 +358,10 @@ static __poll_t iommufd_fault_fops_poll(struct file *filep, 
	__poll_t pollflags = EPOLLOUT;



	poll_wait(filep, &fault->wait_queue, wait);

	mutex_lock(&fault->mutex);

	spin_lock(&fault->lock);

	if (!list_empty(&fault->deliver))

		pollflags |= EPOLLIN | EPOLLRDNORM;

	mutex_unlock(&fault->mutex);

	spin_unlock(&fault->lock);



	return pollflags;

}
@@ -386,6 +403,7 @@ int iommufd_fault_alloc(struct iommufd_ucmd *ucmd) 
	INIT_LIST_HEAD(&fault->deliver);

	xa_init_flags(&fault->response, XA_FLAGS_ALLOC1);

	mutex_init(&fault->mutex);

	spin_lock_init(&fault->lock);

	init_waitqueue_head(&fault->wait_queue);



	filep = anon_inode_getfile("[iommufd-pgfault]", &iommufd_fault_fops,
@@ -434,9 +452,9 @@ int iommufd_fault_iopf_handler(struct iopf_group *group) 
	hwpt = group->attach_handle->domain->fault_data;

	fault = hwpt->fault;



	mutex_lock(&fault->mutex);

	spin_lock(&fault->lock);

	list_add_tail(&group->node, &fault->deliver);

	mutex_unlock(&fault->mutex);

	spin_unlock(&fault->lock);



	wake_up_interruptible(&fault->wait_queue);

drivers/iommu/iommufd/hw_pagetable.c

+7 −3
Original line number Diff line number Diff line
@@ -140,8 +140,8 @@ iommufd_hwpt_paging_alloc(struct iommufd_ctx *ictx, struct iommufd_ioas *ioas, 
	hwpt_paging->nest_parent = flags & IOMMU_HWPT_ALLOC_NEST_PARENT;



	if (ops->domain_alloc_paging_flags) {

		hwpt->domain = ops->domain_alloc_paging_flags(idev->dev, flags,

							      user_data);

		hwpt->domain = ops->domain_alloc_paging_flags(idev->dev,

				flags & ~IOMMU_HWPT_FAULT_ID_VALID, user_data);

		if (IS_ERR(hwpt->domain)) {

			rc = PTR_ERR(hwpt->domain);

			hwpt->domain = NULL;
@@ -280,6 +280,8 @@ iommufd_viommu_alloc_hwpt_nested(struct iommufd_viommu *viommu, u32 flags, 
	struct iommufd_hw_pagetable *hwpt;

	int rc;



	if (flags & ~IOMMU_HWPT_FAULT_ID_VALID)

		return ERR_PTR(-EOPNOTSUPP);

	if (!user_data->len)

		return ERR_PTR(-EOPNOTSUPP);

	if (!viommu->ops || !viommu->ops->alloc_domain_nested)
@@ -296,7 +298,9 @@ iommufd_viommu_alloc_hwpt_nested(struct iommufd_viommu *viommu, u32 flags, 
	hwpt_nested->parent = viommu->hwpt;



	hwpt->domain =

		viommu->ops->alloc_domain_nested(viommu, flags, user_data);

		viommu->ops->alloc_domain_nested(viommu,

				flags & ~IOMMU_HWPT_FAULT_ID_VALID,

				user_data);

	if (IS_ERR(hwpt->domain)) {

		rc = PTR_ERR(hwpt->domain);

		hwpt->domain = NULL;

drivers/iommu/iommufd/iommufd_private.h

+27 −2
Original line number Diff line number Diff line
@@ -443,14 +443,39 @@ struct iommufd_fault { 
	struct iommufd_ctx *ictx;

	struct file *filep;



	/* The lists of outstanding faults protected by below mutex. */

	struct mutex mutex;

	spinlock_t lock; /* protects the deliver list */

	struct list_head deliver;

	struct mutex mutex; /* serializes response flows */

	struct xarray response;



	struct wait_queue_head wait_queue;

};



/* Fetch the first node out of the fault->deliver list */

static inline struct iopf_group *

iommufd_fault_deliver_fetch(struct iommufd_fault *fault)

{

	struct list_head *list = &fault->deliver;

	struct iopf_group *group = NULL;



	spin_lock(&fault->lock);

	if (!list_empty(list)) {

		group = list_first_entry(list, struct iopf_group, node);

		list_del(&group->node);

	}

	spin_unlock(&fault->lock);

	return group;

}



/* Restore a node back to the head of the fault->deliver list */

static inline void iommufd_fault_deliver_restore(struct iommufd_fault *fault,

						 struct iopf_group *group)

{

	spin_lock(&fault->lock);

	list_add(&group->node, &fault->deliver);

	spin_unlock(&fault->lock);

}



struct iommufd_attach_handle {

	struct iommu_attach_handle handle;

	struct iommufd_device *idev;