Skip to content

Commit 13c6bba

Browse files
torvaldstorvalds
committed
Merge tag 'iommu-fixes-v6.11-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux
Pull iommu fixes from Joerg Roedel: - Fix a device-stall problem in bad io-page-fault setups (faults received from devices with no supporting domain attached). - Context flush fix for Intel VT-d. - Do not allow non-read+non-write mapping through iommufd as most implementations can not handle that. - Fix a possible infinite-loop issue in map_pages() path. - Add Jean-Philippe as reviewer for SMMUv3 SVA support * tag 'iommu-fixes-v6.11-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux: MAINTAINERS: Add Jean-Philippe as SMMUv3 SVA reviewer iommu: Do not return 0 from map_pages if it doesn't do anything iommufd: Do not allow creating areas without READ or WRITE iommu/vt-d: Fix incorrect domain ID in context flush helper iommu: Handle iommu faults for a bad iopf setup
2 parents 20371ba + 51eeef9 commit 13c6bba

File tree

12 files changed

+116
-56
lines changed

12 files changed

+116
-56
lines changed

‎MAINTAINERS‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1880,6 +1880,10 @@ F: Documentation/devicetree/bindings/iommu/arm,smmu*
18801880
F: drivers/iommu/arm/
18811881
F: drivers/iommu/io-pgtable-arm*
18821882

1883+
ARM SMMU SVA SUPPORT
1884+
R: Jean-Philippe Brucker <[email protected]>
1885+
F: drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-sva.c
1886+
18831887
ARM SUB-ARCHITECTURES
18841888
L: [email protected] (moderated for non-subscribers)
18851889
S: Maintained

‎drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1777,7 +1777,7 @@ static int arm_smmu_handle_evt(struct arm_smmu_device *smmu, u64 *evt)
17771777
goto out_unlock;
17781778
}
17791779

1780-
iommu_report_device_fault(master->dev, &fault_evt);
1780+
ret = iommu_report_device_fault(master->dev, &fault_evt);
17811781
out_unlock:
17821782
mutex_unlock(&smmu->streams_mutex);
17831783
return ret;

‎drivers/iommu/intel/iommu.c‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1944,6 +1944,7 @@ static void domain_context_clear_one(struct device_domain_info *info, u8 bus, u8
19441944
{
19451945
struct intel_iommu *iommu = info->iommu;
19461946
struct context_entry *context;
1947+
u16 did;
19471948

19481949
spin_lock(&iommu->lock);
19491950
context = iommu_context_addr(iommu, bus, devfn, 0);
@@ -1952,10 +1953,11 @@ static void domain_context_clear_one(struct device_domain_info *info, u8 bus, u8
19521953
return;
19531954
}
19541955

1956+
did = context_domain_id(context);
19551957
context_clear_entry(context);
19561958
__iommu_flush_cache(iommu, context, sizeof(*context));
19571959
spin_unlock(&iommu->lock);
1958-
intel_context_flush_present(info, context, true);
1960+
intel_context_flush_present(info, context, did, true);
19591961
}
19601962

19611963
static int domain_setup_first_level(struct intel_iommu *iommu,
@@ -4249,6 +4251,7 @@ static int context_flip_pri(struct device_domain_info *info, bool enable)
42494251
struct intel_iommu *iommu = info->iommu;
42504252
u8 bus = info->bus, devfn = info->devfn;
42514253
struct context_entry *context;
4254+
u16 did;
42524255

42534256
spin_lock(&iommu->lock);
42544257
if (context_copied(iommu, bus, devfn)) {
@@ -4261,6 +4264,7 @@ static int context_flip_pri(struct device_domain_info *info, bool enable)
42614264
spin_unlock(&iommu->lock);
42624265
return -ENODEV;
42634266
}
4267+
did = context_domain_id(context);
42644268

42654269
if (enable)
42664270
context_set_sm_pre(context);
@@ -4269,7 +4273,7 @@ static int context_flip_pri(struct device_domain_info *info, bool enable)
42694273

42704274
if (!ecap_coherent(iommu->ecap))
42714275
clflush_cache_range(context, sizeof(*context));
4272-
intel_context_flush_present(info, context, true);
4276+
intel_context_flush_present(info, context, did, true);
42734277
spin_unlock(&iommu->lock);
42744278

42754279
return 0;

‎drivers/iommu/intel/iommu.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1154,7 +1154,7 @@ void cache_tag_flush_range_np(struct dmar_domain *domain, unsigned long start,
11541154

11551155
void intel_context_flush_present(struct device_domain_info *info,
11561156
struct context_entry *context,
1157-
bool affect_domains);
1157+
u16 did, bool affect_domains);
11581158

11591159
#ifdef CONFIG_INTEL_IOMMU_SVM
11601160
void intel_svm_check(struct intel_iommu *iommu);

‎drivers/iommu/intel/pasid.c‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -683,6 +683,7 @@ static void device_pasid_table_teardown(struct device *dev, u8 bus, u8 devfn)
683683
struct device_domain_info *info = dev_iommu_priv_get(dev);
684684
struct intel_iommu *iommu = info->iommu;
685685
struct context_entry *context;
686+
u16 did;
686687

687688
spin_lock(&iommu->lock);
688689
context = iommu_context_addr(iommu, bus, devfn, false);
@@ -691,10 +692,11 @@ static void device_pasid_table_teardown(struct device *dev, u8 bus, u8 devfn)
691692
return;
692693
}
693694

695+
did = context_domain_id(context);
694696
context_clear_entry(context);
695697
__iommu_flush_cache(iommu, context, sizeof(*context));
696698
spin_unlock(&iommu->lock);
697-
intel_context_flush_present(info, context, false);
699+
intel_context_flush_present(info, context, did, false);
698700
}
699701

700702
static int pci_pasid_table_teardown(struct pci_dev *pdev, u16 alias, void *data)
@@ -885,10 +887,9 @@ static void __context_flush_dev_iotlb(struct device_domain_info *info)
885887
*/
886888
void intel_context_flush_present(struct device_domain_info *info,
887889
struct context_entry *context,
888-
bool flush_domains)
890+
u16 did, bool flush_domains)
889891
{
890892
struct intel_iommu *iommu = info->iommu;
891-
u16 did = context_domain_id(context);
892893
struct pasid_entry *pte;
893894
int i;
894895

‎drivers/iommu/io-pgfault.c‎

Lines changed: 83 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -115,6 +115,59 @@ static struct iopf_group *iopf_group_alloc(struct iommu_fault_param *iopf_param,
115115
return group;
116116
}
117117

118+
static struct iommu_attach_handle *find_fault_handler(struct device *dev,
119+
struct iopf_fault *evt)
120+
{
121+
struct iommu_fault *fault = &evt->fault;
122+
struct iommu_attach_handle *attach_handle;
123+
124+
if (fault->prm.flags & IOMMU_FAULT_PAGE_REQUEST_PASID_VALID) {
125+
attach_handle = iommu_attach_handle_get(dev->iommu_group,
126+
fault->prm.pasid, 0);
127+
if (IS_ERR(attach_handle)) {
128+
const struct iommu_ops *ops = dev_iommu_ops(dev);
129+
130+
if (!ops->user_pasid_table)
131+
return NULL;
132+
/*
133+
* The iommu driver for this device supports user-
134+
* managed PASID table. Therefore page faults for
135+
* any PASID should go through the NESTING domain
136+
* attached to the device RID.
137+
*/
138+
attach_handle = iommu_attach_handle_get(
139+
dev->iommu_group, IOMMU_NO_PASID,
140+
IOMMU_DOMAIN_NESTED);
141+
if (IS_ERR(attach_handle))
142+
return NULL;
143+
}
144+
} else {
145+
attach_handle = iommu_attach_handle_get(dev->iommu_group,
146+
IOMMU_NO_PASID, 0);
147+
148+
if (IS_ERR(attach_handle))
149+
return NULL;
150+
}
151+
152+
if (!attach_handle->domain->iopf_handler)
153+
return NULL;
154+
155+
return attach_handle;
156+
}
157+
158+
static void iopf_error_response(struct device *dev, struct iopf_fault *evt)
159+
{
160+
const struct iommu_ops *ops = dev_iommu_ops(dev);
161+
struct iommu_fault *fault = &evt->fault;
162+
struct iommu_page_response resp = {
163+
.pasid = fault->prm.pasid,
164+
.grpid = fault->prm.grpid,
165+
.code = IOMMU_PAGE_RESP_INVALID
166+
};
167+
168+
ops->page_response(dev, evt, &resp);
169+
}
170+
118171
/**
119172
* iommu_report_device_fault() - Report fault event to device driver
120173
* @dev: the device
@@ -153,24 +206,39 @@ static struct iopf_group *iopf_group_alloc(struct iommu_fault_param *iopf_param,
153206
* handling framework should guarantee that the iommu domain could only be
154207
* freed after the device has stopped generating page faults (or the iommu
155208
* hardware has been set to block the page faults) and the pending page faults
156-
* have been flushed.
209+
* have been flushed. In case no page fault handler is attached or no iopf params
210+
* are setup, then the ops->page_response() is called to complete the evt.
211+
*
212+
* Returns 0 on success, or an error in case of a bad/failed iopf setup.
157213
*/
158-
void iommu_report_device_fault(struct device *dev, struct iopf_fault *evt)
214+
int iommu_report_device_fault(struct device *dev, struct iopf_fault *evt)
159215
{
216+
struct iommu_attach_handle *attach_handle;
160217
struct iommu_fault *fault = &evt->fault;
161218
struct iommu_fault_param *iopf_param;
162219
struct iopf_group abort_group = {};
163220
struct iopf_group *group;
164221

222+
attach_handle = find_fault_handler(dev, evt);
223+
if (!attach_handle)
224+
goto err_bad_iopf;
225+
226+
/*
227+
* Something has gone wrong if a fault capable domain is attached but no
228+
* iopf_param is setup
229+
*/
165230
iopf_param = iopf_get_dev_fault_param(dev);
166231
if (WARN_ON(!iopf_param))
167-
return;
232+
goto err_bad_iopf;
168233

169234
if (!(fault->prm.flags & IOMMU_FAULT_PAGE_REQUEST_LAST_PAGE)) {
170-
report_partial_fault(iopf_param, fault);
235+
int ret;
236+
237+
ret = report_partial_fault(iopf_param, fault);
171238
iopf_put_dev_fault_param(iopf_param);
172239
/* A request that is not the last does not need to be ack'd */
173-
return;
240+
241+
return ret;
174242
}
175243

176244
/*
@@ -185,38 +253,7 @@ void iommu_report_device_fault(struct device *dev, struct iopf_fault *evt)
185253
if (group == &abort_group)
186254
goto err_abort;
187255

188-
if (fault->prm.flags & IOMMU_FAULT_PAGE_REQUEST_PASID_VALID) {
189-
group->attach_handle = iommu_attach_handle_get(dev->iommu_group,
190-
fault->prm.pasid,
191-
0);
192-
if (IS_ERR(group->attach_handle)) {
193-
const struct iommu_ops *ops = dev_iommu_ops(dev);
194-
195-
if (!ops->user_pasid_table)
196-
goto err_abort;
197-
198-
/*
199-
* The iommu driver for this device supports user-
200-
* managed PASID table. Therefore page faults for
201-
* any PASID should go through the NESTING domain
202-
* attached to the device RID.
203-
*/
204-
group->attach_handle =
205-
iommu_attach_handle_get(dev->iommu_group,
206-
IOMMU_NO_PASID,
207-
IOMMU_DOMAIN_NESTED);
208-
if (IS_ERR(group->attach_handle))
209-
goto err_abort;
210-
}
211-
} else {
212-
group->attach_handle =
213-
iommu_attach_handle_get(dev->iommu_group, IOMMU_NO_PASID, 0);
214-
if (IS_ERR(group->attach_handle))
215-
goto err_abort;
216-
}
217-
218-
if (!group->attach_handle->domain->iopf_handler)
219-
goto err_abort;
256+
group->attach_handle = attach_handle;
220257

221258
/*
222259
* On success iopf_handler must call iopf_group_response() and
@@ -225,7 +262,7 @@ void iommu_report_device_fault(struct device *dev, struct iopf_fault *evt)
225262
if (group->attach_handle->domain->iopf_handler(group))
226263
goto err_abort;
227264

228-
return;
265+
return 0;
229266

230267
err_abort:
231268
dev_warn_ratelimited(dev, "iopf with pasid %d aborted\n",
@@ -235,6 +272,14 @@ void iommu_report_device_fault(struct device *dev, struct iopf_fault *evt)
235272
__iopf_free_group(group);
236273
else
237274
iopf_free_group(group);
275+
276+
return 0;
277+
278+
err_bad_iopf:
279+
if (fault->type == IOMMU_FAULT_PAGE_REQ)
280+
iopf_error_response(dev, evt);
281+
282+
return -EINVAL;
238283
}
239284
EXPORT_SYMBOL_GPL(iommu_report_device_fault);
240285

‎drivers/iommu/io-pgtable-arm-v7s.c‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -552,9 +552,8 @@ static int arm_v7s_map_pages(struct io_pgtable_ops *ops, unsigned long iova,
552552
paddr >= (1ULL << data->iop.cfg.oas)))
553553
return -ERANGE;
554554

555-
/* If no access, then nothing to do */
556555
if (!(prot & (IOMMU_READ | IOMMU_WRITE)))
557-
return 0;
556+
return -EINVAL;
558557

559558
while (pgcount--) {
560559
ret = __arm_v7s_map(data, iova, paddr, pgsize, prot, 1, data->pgd,

‎drivers/iommu/io-pgtable-arm.c‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -515,9 +515,8 @@ static int arm_lpae_map_pages(struct io_pgtable_ops *ops, unsigned long iova,
515515
if (WARN_ON(iaext || paddr >> cfg->oas))
516516
return -ERANGE;
517517

518-
/* If no access, then nothing to do */
519518
if (!(iommu_prot & (IOMMU_READ | IOMMU_WRITE)))
520-
return 0;
519+
return -EINVAL;
521520

522521
prot = arm_lpae_prot_to_pte(data, iommu_prot);
523522
ret = __arm_lpae_map(data, iova, paddr, pgsize, pgcount, prot, lvl,

‎drivers/iommu/io-pgtable-dart.c‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -245,9 +245,8 @@ static int dart_map_pages(struct io_pgtable_ops *ops, unsigned long iova,
245245
if (WARN_ON(paddr >> cfg->oas))
246246
return -ERANGE;
247247

248-
/* If no access, then nothing to do */
249248
if (!(iommu_prot & (IOMMU_READ | IOMMU_WRITE)))
250-
return 0;
249+
return -EINVAL;
251250

252251
tbl = dart_get_table(data, iova);
253252

‎drivers/iommu/iommufd/ioas.c‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -213,6 +213,10 @@ int iommufd_ioas_map(struct iommufd_ucmd *ucmd)
213213
if (cmd->iova >= ULONG_MAX || cmd->length >= ULONG_MAX)
214214
return -EOVERFLOW;
215215

216+
if (!(cmd->flags &
217+
(IOMMU_IOAS_MAP_WRITEABLE | IOMMU_IOAS_MAP_READABLE)))
218+
return -EINVAL;
219+
216220
ioas = iommufd_get_ioas(ucmd->ictx, cmd->ioas_id);
217221
if (IS_ERR(ioas))
218222
return PTR_ERR(ioas);
@@ -253,6 +257,10 @@ int iommufd_ioas_copy(struct iommufd_ucmd *ucmd)
253257
cmd->dst_iova >= ULONG_MAX)
254258
return -EOVERFLOW;
255259

260+
if (!(cmd->flags &
261+
(IOMMU_IOAS_MAP_WRITEABLE | IOMMU_IOAS_MAP_READABLE)))
262+
return -EINVAL;
263+
256264
src_ioas = iommufd_get_ioas(ucmd->ictx, cmd->src_ioas_id);
257265
if (IS_ERR(src_ioas))
258266
return PTR_ERR(src_ioas);

0 commit comments

Comments
 (0)