From: Alex Williamson <alex.williamson@redhat.com>
To: Liu Yi L <yi.l.liu@intel.com>
Cc: eric.auger@redhat.com, kevin.tian@intel.com,
jacob.jun.pan@linux.intel.com, joro@8bytes.org,
ashok.raj@intel.com, jun.j.tian@intel.com, yi.y.sun@intel.com,
jean-philippe.brucker@arm.com, peterx@redhat.com,
iommu@lists.linux-foundation.org, kvm@vger.kernel.org
Subject: Re: [RFC v2 2/3] vfio/type1: VFIO_IOMMU_PASID_REQUEST(alloc/free)
Date: Tue, 5 Nov 2019 16:35:37 -0700 [thread overview]
Message-ID: <20191105163537.1935291c@x1.home> (raw)
In-Reply-To: <1571919983-3231-3-git-send-email-yi.l.liu@intel.com>
On Thu, 24 Oct 2019 08:26:22 -0400
Liu Yi L <yi.l.liu@intel.com> wrote:
> This patch adds VFIO_IOMMU_PASID_REQUEST ioctl which aims
> to passdown PASID allocation/free request from the virtual
> iommu. This is required to get PASID managed in system-wide.
>
> Cc: Kevin Tian <kevin.tian@intel.com>
> Signed-off-by: Liu Yi L <yi.l.liu@intel.com>
> Signed-off-by: Yi Sun <yi.y.sun@linux.intel.com>
> Signed-off-by: Jacob Pan <jacob.jun.pan@linux.intel.com>
> ---
> drivers/vfio/vfio_iommu_type1.c | 114 ++++++++++++++++++++++++++++++++++++++++
> include/uapi/linux/vfio.h | 25 +++++++++
> 2 files changed, 139 insertions(+)
>
> diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c
> index cd8d3a5..3d73a7d 100644
> --- a/drivers/vfio/vfio_iommu_type1.c
> +++ b/drivers/vfio/vfio_iommu_type1.c
> @@ -2248,6 +2248,83 @@ static int vfio_cache_inv_fn(struct device *dev, void *data)
> return iommu_cache_invalidate(dc->domain, dev, &ustruct->info);
> }
>
> +static int vfio_iommu_type1_pasid_alloc(struct vfio_iommu *iommu,
> + int min_pasid,
> + int max_pasid)
> +{
> + int ret;
> + ioasid_t pasid;
> + struct mm_struct *mm = NULL;
> +
> + mutex_lock(&iommu->lock);
> + if (!IS_IOMMU_CAP_DOMAIN_IN_CONTAINER(iommu)) {
> + ret = -EINVAL;
> + goto out_unlock;
> + }
> + mm = get_task_mm(current);
> + /* Track ioasid allocation owner by mm */
> + pasid = ioasid_alloc((struct ioasid_set *)mm, min_pasid,
> + max_pasid, NULL);
Are we sure we want to tie this to the task mm vs perhaps the
vfio_iommu pointer?
> + if (pasid == INVALID_IOASID) {
> + ret = -ENOSPC;
> + goto out_unlock;
> + }
> + ret = pasid;
> +out_unlock:
> + mutex_unlock(&iommu->lock);
> + if (mm)
> + mmput(mm);
> + return ret;
> +}
> +
> +static int vfio_iommu_type1_pasid_free(struct vfio_iommu *iommu,
> + unsigned int pasid)
> +{
> + struct mm_struct *mm = NULL;
> + void *pdata;
> + int ret = 0;
> +
> + mutex_lock(&iommu->lock);
> + if (!IS_IOMMU_CAP_DOMAIN_IN_CONTAINER(iommu)) {
> + ret = -EINVAL;
> + goto out_unlock;
> + }
> +
> + /**
> + * REVISIT:
> + * There are two cases free could fail:
> + * 1. free pasid by non-owner, we use ioasid_set to track mm, if
> + * the set does not match, caller is not permitted to free.
> + * 2. free before unbind all devices, we can check if ioasid private
> + * data, if data != NULL, then fail to free.
> + */
> + mm = get_task_mm(current);
> + pdata = ioasid_find((struct ioasid_set *)mm, pasid, NULL);
> + if (IS_ERR(pdata)) {
> + if (pdata == ERR_PTR(-ENOENT))
> + pr_err("PASID %u is not allocated\n", pasid);
> + else if (pdata == ERR_PTR(-EACCES))
> + pr_err("Free PASID %u by non-owner, denied", pasid);
> + else
> + pr_err("Error searching PASID %u\n", pasid);
This should be removed, errno is sufficient for the user, this just
provides the user with a trivial DoS vector filling logs.
> + ret = -EPERM;
But why not return PTR_ERR(pdata)?
> + goto out_unlock;
> + }
> + if (pdata) {
> + pr_debug("Cannot free pasid %d with private data\n", pasid);
> + /* Expect PASID has no private data if not bond */
> + ret = -EBUSY;
> + goto out_unlock;
> + }
> + ioasid_free(pasid);
We only ever get here with pasid == NULL?! Something is wrong. Should
that be 'if (!pdata)'? (which also makes that pr_debug another DoS
vector)
> +
> +out_unlock:
> + if (mm)
> + mmput(mm);
> + mutex_unlock(&iommu->lock);
> + return ret;
> +}
> +
> static long vfio_iommu_type1_ioctl(void *iommu_data,
> unsigned int cmd, unsigned long arg)
> {
> @@ -2370,6 +2447,43 @@ static long vfio_iommu_type1_ioctl(void *iommu_data,
> &ustruct);
> mutex_unlock(&iommu->lock);
> return ret;
> +
> + } else if (cmd == VFIO_IOMMU_PASID_REQUEST) {
> + struct vfio_iommu_type1_pasid_request req;
> + int min_pasid, max_pasid, pasid;
> +
> + minsz = offsetofend(struct vfio_iommu_type1_pasid_request,
> + flag);
> +
> + if (copy_from_user(&req, (void __user *)arg, minsz))
> + return -EFAULT;
> +
> + if (req.argsz < minsz)
> + return -EINVAL;
> +
> + switch (req.flag) {
This works, but it's strange. Let's make the code a little easier for
the next flag bit that gets used so they don't need to rework this case
statement. I'd suggest creating a VFIO_IOMMU_PASID_OPS_MASK that is
the OR of the ALLOC/FREE options, test that no bits are set outside of
that mask, then AND that mask as the switch arg with the code below.
> + /**
> + * TODO: min_pasid and max_pasid align with
> + * typedef unsigned int ioasid_t
> + */
> + case VFIO_IOMMU_PASID_ALLOC:
> + if (copy_from_user(&min_pasid,
> + (void __user *)arg + minsz, sizeof(min_pasid)))
> + return -EFAULT;
> + if (copy_from_user(&max_pasid,
> + (void __user *)arg + minsz + sizeof(min_pasid),
> + sizeof(max_pasid)))
> + return -EFAULT;
> + return vfio_iommu_type1_pasid_alloc(iommu,
> + min_pasid, max_pasid);
> + case VFIO_IOMMU_PASID_FREE:
> + if (copy_from_user(&pasid,
> + (void __user *)arg + minsz, sizeof(pasid)))
> + return -EFAULT;
> + return vfio_iommu_type1_pasid_free(iommu, pasid);
> + default:
> + return -EINVAL;
> + }
> }
>
> return -ENOTTY;
> diff --git a/include/uapi/linux/vfio.h b/include/uapi/linux/vfio.h
> index ccf60a2..04de290 100644
> --- a/include/uapi/linux/vfio.h
> +++ b/include/uapi/linux/vfio.h
> @@ -807,6 +807,31 @@ struct vfio_iommu_type1_cache_invalidate {
> };
> #define VFIO_IOMMU_CACHE_INVALIDATE _IO(VFIO_TYPE, VFIO_BASE + 24)
>
> +/*
> + * @flag=VFIO_IOMMU_PASID_ALLOC, refer to the @min_pasid and @max_pasid fields
> + * @flag=VFIO_IOMMU_PASID_FREE, refer to @pasid field
> + */
> +struct vfio_iommu_type1_pasid_request {
> + __u32 argsz;
> +#define VFIO_IOMMU_PASID_ALLOC (1 << 0)
> +#define VFIO_IOMMU_PASID_FREE (1 << 1)
> + __u32 flag;
> + union {
> + struct {
> + int min_pasid;
> + int max_pasid;
> + };
> + int pasid;
Perhaps:
struct {
u32 min;
u32 max;
} alloc_pasid;
u32 free_pasid;
(note also the s/int/u32/)
> + };
> +};
> +
> +/**
> + * VFIO_IOMMU_PASID_REQUEST - _IOWR(VFIO_TYPE, VFIO_BASE + 27,
> + * struct vfio_iommu_type1_pasid_request)
> + *
> + */
> +#define VFIO_IOMMU_PASID_REQUEST _IO(VFIO_TYPE, VFIO_BASE + 27)
> +
> /* -------- Additional API for SPAPR TCE (Server POWERPC) IOMMU -------- */
>
> /*
next prev parent reply other threads:[~2019-11-05 23:35 UTC|newest]
Thread overview: 32+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-10-24 12:26 [RFC v2 0/3] vfio: support Shared Virtual Addressing Liu Yi L
2019-10-24 12:26 ` [RFC v2 1/3] vfio: VFIO_IOMMU_CACHE_INVALIDATE Liu Yi L
2019-10-25 9:14 ` Tian, Kevin
2019-10-25 11:20 ` Liu, Yi L
2019-11-05 22:42 ` Alex Williamson
2019-11-06 1:31 ` Liu, Yi L
2019-11-13 7:50 ` Auger Eric
2019-10-24 12:26 ` [RFC v2 2/3] vfio/type1: VFIO_IOMMU_PASID_REQUEST(alloc/free) Liu Yi L
2019-10-25 10:06 ` Tian, Kevin
2019-10-25 11:16 ` Liu, Yi L
2019-11-05 23:35 ` Alex Williamson [this message]
2019-11-06 13:27 ` Liu, Yi L
2019-11-07 22:06 ` Alex Williamson
2019-11-08 12:23 ` Liu, Yi L
2019-11-08 15:15 ` Alex Williamson
2019-11-13 11:03 ` Liu, Yi L
2019-11-13 15:29 ` Alex Williamson
2019-11-13 19:45 ` Jacob Pan
2019-11-25 8:32 ` Liu, Yi L
2019-11-18 4:50 ` Liu, Yi L
2019-10-24 12:26 ` [RFC v2 3/3] vfio/type1: bind guest pasid (guest page tables) to host Liu Yi L
2019-11-07 23:20 ` Alex Williamson
2019-11-12 11:21 ` Liu, Yi L
2019-11-12 17:25 ` Alex Williamson
2019-11-13 7:43 ` Liu, Yi L
2019-11-13 10:29 ` Jean-Philippe Brucker
2019-11-13 11:30 ` Liu, Yi L
2019-11-25 7:45 ` Liu, Yi L
2019-12-03 0:11 ` Alex Williamson
2019-12-05 12:19 ` Liu, Yi L
2019-10-25 8:59 ` [RFC v2 0/3] vfio: support Shared Virtual Addressing Tian, Kevin
2019-10-25 11:18 ` Liu, Yi L
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20191105163537.1935291c@x1.home \
--to=alex.williamson@redhat.com \
--cc=ashok.raj@intel.com \
--cc=eric.auger@redhat.com \
--cc=iommu@lists.linux-foundation.org \
--cc=jacob.jun.pan@linux.intel.com \
--cc=jean-philippe.brucker@arm.com \
--cc=joro@8bytes.org \
--cc=jun.j.tian@intel.com \
--cc=kevin.tian@intel.com \
--cc=kvm@vger.kernel.org \
--cc=peterx@redhat.com \
--cc=yi.l.liu@intel.com \
--cc=yi.y.sun@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).