From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.3 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,USER_AGENT_SANE_1 autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3C627C2D0EA for ; Wed, 8 Apr 2020 12:10:01 +0000 (UTC) Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 08DCB20747 for ; Wed, 8 Apr 2020 12:10:01 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=lists.infradead.org header.i=@lists.infradead.org header.b="Vfojd6fc" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 08DCB20747 Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=arm.com Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-mediatek-bounces+linux-mediatek=archiver.kernel.org@lists.infradead.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20170209; h=Sender:Content-Type: Content-Transfer-Encoding:Cc:List-Subscribe:List-Help:List-Post:List-Archive: List-Unsubscribe:List-Id:In-Reply-To:MIME-Version:Date:Message-ID:From: References:To:Subject:Reply-To:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=ejUe071RwlDoakuKDx2Pzo2Bvl1ZomCCYN+dW6r/o7A=; b=Vfojd6fcQLcdH9SqDkDfsSbEa GBGvM0Rsnz/+FZvfPHx5qMuv8ovQNsRef5P3Y+OlgNhX0ubkr9mOvRhC5L6fuX4Fy9jRG4mdW2Qt/ 8kcZ4zhsOUNRLSA543pvQj9+fedqlKUR51J2kDhOuL7yey9MSwXxot4700zm3kowGnL/h4VhwaJYG gm33MK93zwDncLnYxbwLUmJAA/lb89FOJXqfOgMGAhQBl7MNAnTTDuuFzEEEluC9WoX5kTtJGY2W3 indqm96kc0NPvnVZXcVkiKjrWavrrP5y1h5oo3tquYWT4y8LS7GrGl4AqMrjooqR/Nbnsxk6pImiO iPJ0GSyvg==; Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.92.3 #3 (Red Hat Linux)) id 1jM9Wj-00071d-RM; Wed, 08 Apr 2020 12:09:53 +0000 Received: from foss.arm.com ([217.140.110.172]) by bombadil.infradead.org with esmtp (Exim 4.92.3 #3 (Red Hat Linux)) id 1jM9Wg-00070j-Cn; Wed, 08 Apr 2020 12:09:51 +0000 Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 5703C31B; Wed, 8 Apr 2020 05:09:47 -0700 (PDT) Received: from [10.57.55.221] (unknown [10.57.55.221]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPSA id AA7BA3F73D; Wed, 8 Apr 2020 05:09:43 -0700 (PDT) Subject: Re: [RFC PATCH 17/34] iommu/arm-smmu: Store device instead of group in arm_smmu_s2cr To: Joerg Roedel , Will Deacon , Marek Szyprowski , Kukjin Kim , Krzysztof Kozlowski , David Woodhouse , Lu Baolu , Andy Gross , Bjorn Andersson , Matthias Brugger , Rob Clark , Heiko Stuebner , Gerald Schaefer , Thierry Reding , Jonathan Hunter , Jean-Philippe Brucker References: <20200407183742.4344-1-joro@8bytes.org> <20200407183742.4344-18-joro@8bytes.org> From: Robin Murphy Message-ID: <98c10a41-d223-e375-9742-b6471c3dc33c@arm.com> Date: Wed, 8 Apr 2020 13:09:40 +0100 User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Thunderbird/68.6.0 MIME-Version: 1.0 In-Reply-To: <20200407183742.4344-18-joro@8bytes.org> Content-Language: en-GB X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20200408_050950_477074_043AA882 X-CRM114-Status: GOOD ( 24.18 ) X-BeenThere: linux-mediatek@lists.infradead.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: linux-s390@vger.kernel.org, linux-samsung-soc@vger.kernel.org, linux-arm-msm@vger.kernel.org, linux-kernel@vger.kernel.org, virtualization@lists.linux-foundation.org, linux-rockchip@lists.infradead.org, iommu@lists.linux-foundation.org, Joerg Roedel , linux-mediatek@lists.infradead.org, linux-tegra@vger.kernel.org Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="us-ascii"; Format="flowed" Sender: "Linux-mediatek" Errors-To: linux-mediatek-bounces+linux-mediatek=archiver.kernel.org@lists.infradead.org On 2020-04-07 7:37 pm, Joerg Roedel wrote: > From: Joerg Roedel > > This is required to convert the arm-smmu driver to the > probe/release_device() interface. > > Signed-off-by: Joerg Roedel > --- > drivers/iommu/arm-smmu.c | 14 +++++++++----- > 1 file changed, 9 insertions(+), 5 deletions(-) > > diff --git a/drivers/iommu/arm-smmu.c b/drivers/iommu/arm-smmu.c > index a6a5796e9c41..3493501d8b2c 100644 > --- a/drivers/iommu/arm-smmu.c > +++ b/drivers/iommu/arm-smmu.c > @@ -69,7 +69,7 @@ MODULE_PARM_DESC(disable_bypass, > "Disable bypass streams such that incoming transactions from devices that are not attached to an iommu domain will report an abort back to the device and will not be allowed to pass through the SMMU."); > > struct arm_smmu_s2cr { > - struct iommu_group *group; > + struct device *dev; > int count; > enum arm_smmu_s2cr_type type; > enum arm_smmu_s2cr_privcfg privcfg; > @@ -1100,7 +1100,7 @@ static int arm_smmu_master_alloc_smes(struct device *dev) > /* It worked! Now, poke the actual hardware */ > for_each_cfg_sme(cfg, fwspec, i, idx) { > arm_smmu_write_sme(smmu, idx); > - smmu->s2crs[idx].group = group; > + smmu->s2crs[idx].dev = dev; > } > > mutex_unlock(&smmu->stream_map_mutex); > @@ -1495,11 +1495,15 @@ static struct iommu_group *arm_smmu_device_group(struct device *dev) > int i, idx; > > for_each_cfg_sme(cfg, fwspec, i, idx) { > - if (group && smmu->s2crs[idx].group && > - group != smmu->s2crs[idx].group) > + struct iommu_group *idx_grp = NULL; > + > + if (smmu->s2crs[idx].dev) > + idx_grp = smmu->s2crs[idx].dev->iommu_group; For a hot-pluggable bus where logical devices may share Stream IDs (like fsl-mc), this could happen: create device A iommu_probe_device(A) iommu_device_group(A) -> alloc group X create device B iommu_probe_device(B) iommu_device_group(A) -> lookup returns group X ... iommu_remove_device(A) delete device A create device C iommu_probe_device(C) iommu_device_group(C) -> use-after-free of A Preserving the logical behaviour here would probably look *something* like the mangled diff below, but I haven't thought it through 100%. Robin. ----->8----- diff --git a/drivers/iommu/arm-smmu.c b/drivers/iommu/arm-smmu.c index 16c4b87af42b..e88612ee47fe 100644 --- a/drivers/iommu/arm-smmu.c +++ b/drivers/iommu/arm-smmu.c @@ -1100,10 +1100,8 @@ static int arm_smmu_master_alloc_smes(struct device *dev) iommu_group_put(group); /* It worked! Now, poke the actual hardware */ - for_each_cfg_sme(fwspec, i, idx) { + for_each_cfg_sme(fwspec, i, idx) arm_smmu_write_sme(smmu, idx); - smmu->s2crs[idx].group = group; - } mutex_unlock(&smmu->stream_map_mutex); return 0; @@ -1500,15 +1498,17 @@ static struct iommu_group *arm_smmu_device_group(struct device *dev) } if (group) - return iommu_group_ref_get(group); - - if (dev_is_pci(dev)) + iommu_group_ref_get(group); + else if (dev_is_pci(dev)) group = pci_device_group(dev); else if (dev_is_fsl_mc(dev)) group = fsl_mc_device_group(dev); else group = generic_device_group(dev); + for_each_cfg_sme(fwspec, i, idx) + smmu->s2crs[idx].group = group; + return group; } _______________________________________________ Linux-mediatek mailing list Linux-mediatek@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-mediatek