From: Lu Baolu <baolu.lu@linux.intel.com> To: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, Joerg Roedel <joro@8bytes.org>, Alex Williamson <alex.williamson@redhat.com>, Bjorn Helgaas <bhelgaas@google.com>, Jason Gunthorpe <jgg@nvidia.com>, Christoph Hellwig <hch@infradead.org>, Kevin Tian <kevin.tian@intel.com>, Ashok Raj <ashok.raj@intel.com> Cc: kvm@vger.kernel.org, rafael@kernel.org, David Airlie <airlied@linux.ie>, linux-pci@vger.kernel.org, Thierry Reding <thierry.reding@gmail.com>, Diana Craciun <diana.craciun@oss.nxp.com>, Will Deacon <will@kernel.org>, Stuart Yoder <stuyoder@gmail.com>, Jonathan Hunter <jonathanh@nvidia.com>, Chaitanya Kulkarni <kch@nvidia.com>, Dan Williams <dan.j.williams@intel.com>, Cornelia Huck <cohuck@redhat.com>, linux-kernel@vger.kernel.org, Li Yang <leoyang.li@nxp.com>, iommu@lists.linux-foundation.org, Jacob jun Pan <jacob.jun.pan@intel.com>, Daniel Vetter <daniel@ffwll.ch>, Robin Murphy <robin.murphy@arm.com> Subject: [PATCH v2 02/17] driver core: Add dma_unconfigure callback in bus_type Date: Sun, 28 Nov 2021 10:50:36 +0800 [thread overview] Message-ID: <20211128025051.355578-3-baolu.lu@linux.intel.com> (raw) In-Reply-To: <20211128025051.355578-1-baolu.lu@linux.intel.com> The bus_type structure defines dma_configure() callback for bus drivers to configure DMA on the devices. This adds the paired dma_unconfigure() callback and calls it during driver unbinding so that bus drivers can do some cleanup work. One use case for this paired DMA callbacks is for the bus driver to check for DMA ownership conflicts during driver binding, where multiple devices belonging to a same IOMMU group (the minimum granularity of isolation and protection) may be assigned to kernel drivers or user space respectively. Without this change, for example, the vfio driver has to listen to a bus BOUND_DRIVER event and then BUG_ON() in case of dma ownership conflict. This leads to bad user experience since careless driver binding operation may crash the system if the admin overlooks the group restriction. Aside from bad design, this leads to a security problem as a root user, even with lockdown=integrity, can force the kernel to BUG. With this change, the bus driver could check and set the DMA ownership in driver binding process and fail on ownership conflicts. The DMA ownership should be released during driver unbinding. Suggested-by: Jason Gunthorpe <jgg@nvidia.com> Link: https://lore.kernel.org/linux-iommu/20210922123931.GI327412@nvidia.com/ Link: https://lore.kernel.org/linux-iommu/20210928115751.GK964074@nvidia.com/ Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com> --- include/linux/device/bus.h | 3 +++ drivers/base/dd.c | 7 ++++++- 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/include/linux/device/bus.h b/include/linux/device/bus.h index a039ab809753..ef54a71e5f8f 100644 --- a/include/linux/device/bus.h +++ b/include/linux/device/bus.h @@ -59,6 +59,8 @@ struct fwnode_handle; * bus supports. * @dma_configure: Called to setup DMA configuration on a device on * this bus. + * @dma_unconfigure: Called to cleanup DMA configuration on a device on + * this bus. * @pm: Power management operations of this bus, callback the specific * device driver's pm-ops. * @iommu_ops: IOMMU specific operations for this bus, used to attach IOMMU @@ -103,6 +105,7 @@ struct bus_type { int (*num_vf)(struct device *dev); int (*dma_configure)(struct device *dev); + void (*dma_unconfigure)(struct device *dev); const struct dev_pm_ops *pm; diff --git a/drivers/base/dd.c b/drivers/base/dd.c index 68ea1f949daa..a37aafff5fde 100644 --- a/drivers/base/dd.c +++ b/drivers/base/dd.c @@ -577,7 +577,7 @@ static int really_probe(struct device *dev, struct device_driver *drv) if (dev->bus->dma_configure) { ret = dev->bus->dma_configure(dev); if (ret) - goto probe_failed; + goto pinctrl_bind_failed; } ret = driver_sysfs_add(dev); @@ -660,6 +660,8 @@ static int really_probe(struct device *dev, struct device_driver *drv) if (dev->bus) blocking_notifier_call_chain(&dev->bus->p->bus_notifier, BUS_NOTIFY_DRIVER_NOT_BOUND, dev); + if (dev->bus->dma_unconfigure) + dev->bus->dma_unconfigure(dev); pinctrl_bind_failed: device_links_no_driver(dev); devres_release_all(dev); @@ -1204,6 +1206,9 @@ static void __device_release_driver(struct device *dev, struct device *parent) else if (drv->remove) drv->remove(dev); + if (dev->bus->dma_unconfigure) + dev->bus->dma_unconfigure(dev); + device_links_driver_cleanup(dev); devres_release_all(dev); -- 2.25.1 _______________________________________________ iommu mailing list iommu@lists.linux-foundation.org https://lists.linuxfoundation.org/mailman/listinfo/iommu
WARNING: multiple messages have this Message-ID (diff)
From: Lu Baolu <baolu.lu@linux.intel.com> To: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, Joerg Roedel <joro@8bytes.org>, Alex Williamson <alex.williamson@redhat.com>, Bjorn Helgaas <bhelgaas@google.com>, Jason Gunthorpe <jgg@nvidia.com>, Christoph Hellwig <hch@infradead.org>, Kevin Tian <kevin.tian@intel.com>, Ashok Raj <ashok.raj@intel.com> Cc: Will Deacon <will@kernel.org>, Robin Murphy <robin.murphy@arm.com>, Dan Williams <dan.j.williams@intel.com>, rafael@kernel.org, Diana Craciun <diana.craciun@oss.nxp.com>, Cornelia Huck <cohuck@redhat.com>, Eric Auger <eric.auger@redhat.com>, Liu Yi L <yi.l.liu@intel.com>, Jacob jun Pan <jacob.jun.pan@intel.com>, Chaitanya Kulkarni <kch@nvidia.com>, Stuart Yoder <stuyoder@gmail.com>, Laurentiu Tudor <laurentiu.tudor@nxp.com>, Thierry Reding <thierry.reding@gmail.com>, David Airlie <airlied@linux.ie>, Daniel Vetter <daniel@ffwll.ch>, Jonathan Hunter <jonathanh@nvidia.com>, Li Yang <leoyang.li@nxp.com>, iommu@lists.linux-foundation.org, linux-pci@vger.kernel.org, kvm@vger.kernel.org, linux-kernel@vger.kernel.org, Lu Baolu <baolu.lu@linux.intel.com> Subject: [PATCH v2 02/17] driver core: Add dma_unconfigure callback in bus_type Date: Sun, 28 Nov 2021 10:50:36 +0800 [thread overview] Message-ID: <20211128025051.355578-3-baolu.lu@linux.intel.com> (raw) In-Reply-To: <20211128025051.355578-1-baolu.lu@linux.intel.com> The bus_type structure defines dma_configure() callback for bus drivers to configure DMA on the devices. This adds the paired dma_unconfigure() callback and calls it during driver unbinding so that bus drivers can do some cleanup work. One use case for this paired DMA callbacks is for the bus driver to check for DMA ownership conflicts during driver binding, where multiple devices belonging to a same IOMMU group (the minimum granularity of isolation and protection) may be assigned to kernel drivers or user space respectively. Without this change, for example, the vfio driver has to listen to a bus BOUND_DRIVER event and then BUG_ON() in case of dma ownership conflict. This leads to bad user experience since careless driver binding operation may crash the system if the admin overlooks the group restriction. Aside from bad design, this leads to a security problem as a root user, even with lockdown=integrity, can force the kernel to BUG. With this change, the bus driver could check and set the DMA ownership in driver binding process and fail on ownership conflicts. The DMA ownership should be released during driver unbinding. Suggested-by: Jason Gunthorpe <jgg@nvidia.com> Link: https://lore.kernel.org/linux-iommu/20210922123931.GI327412@nvidia.com/ Link: https://lore.kernel.org/linux-iommu/20210928115751.GK964074@nvidia.com/ Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com> --- include/linux/device/bus.h | 3 +++ drivers/base/dd.c | 7 ++++++- 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/include/linux/device/bus.h b/include/linux/device/bus.h index a039ab809753..ef54a71e5f8f 100644 --- a/include/linux/device/bus.h +++ b/include/linux/device/bus.h @@ -59,6 +59,8 @@ struct fwnode_handle; * bus supports. * @dma_configure: Called to setup DMA configuration on a device on * this bus. + * @dma_unconfigure: Called to cleanup DMA configuration on a device on + * this bus. * @pm: Power management operations of this bus, callback the specific * device driver's pm-ops. * @iommu_ops: IOMMU specific operations for this bus, used to attach IOMMU @@ -103,6 +105,7 @@ struct bus_type { int (*num_vf)(struct device *dev); int (*dma_configure)(struct device *dev); + void (*dma_unconfigure)(struct device *dev); const struct dev_pm_ops *pm; diff --git a/drivers/base/dd.c b/drivers/base/dd.c index 68ea1f949daa..a37aafff5fde 100644 --- a/drivers/base/dd.c +++ b/drivers/base/dd.c @@ -577,7 +577,7 @@ static int really_probe(struct device *dev, struct device_driver *drv) if (dev->bus->dma_configure) { ret = dev->bus->dma_configure(dev); if (ret) - goto probe_failed; + goto pinctrl_bind_failed; } ret = driver_sysfs_add(dev); @@ -660,6 +660,8 @@ static int really_probe(struct device *dev, struct device_driver *drv) if (dev->bus) blocking_notifier_call_chain(&dev->bus->p->bus_notifier, BUS_NOTIFY_DRIVER_NOT_BOUND, dev); + if (dev->bus->dma_unconfigure) + dev->bus->dma_unconfigure(dev); pinctrl_bind_failed: device_links_no_driver(dev); devres_release_all(dev); @@ -1204,6 +1206,9 @@ static void __device_release_driver(struct device *dev, struct device *parent) else if (drv->remove) drv->remove(dev); + if (dev->bus->dma_unconfigure) + dev->bus->dma_unconfigure(dev); + device_links_driver_cleanup(dev); devres_release_all(dev); -- 2.25.1
next prev parent reply other threads:[~2021-11-28 2:51 UTC|newest] Thread overview: 54+ messages / expand[flat|nested] mbox.gz Atom feed top 2021-11-28 2:50 [PATCH v2 00/17] Fix BUG_ON in vfio_iommu_group_notifier() Lu Baolu 2021-11-28 2:50 ` Lu Baolu 2021-11-28 2:50 ` [PATCH v2 01/17] iommu: Add device dma ownership set/release interfaces Lu Baolu 2021-11-28 2:50 ` Lu Baolu 2021-11-28 2:50 ` Lu Baolu [this message] 2021-11-28 2:50 ` [PATCH v2 02/17] driver core: Add dma_unconfigure callback in bus_type Lu Baolu 2021-11-28 8:02 ` Greg Kroah-Hartman 2021-11-28 8:02 ` Greg Kroah-Hartman 2021-11-29 4:03 ` Lu Baolu 2021-11-29 4:03 ` Lu Baolu 2021-11-28 2:50 ` [PATCH v2 03/17] PCI: Add driver dma ownership management Lu Baolu 2021-11-28 2:50 ` Lu Baolu 2021-11-28 2:50 ` [PATCH v2 04/17] driver core: platform: " Lu Baolu 2021-11-28 2:50 ` Lu Baolu 2021-11-28 8:10 ` Greg Kroah-Hartman 2021-11-28 8:10 ` Greg Kroah-Hartman 2021-11-28 23:15 ` Jason Gunthorpe via iommu 2021-11-28 23:15 ` Jason Gunthorpe 2021-11-29 10:34 ` Greg Kroah-Hartman 2021-11-29 10:34 ` Greg Kroah-Hartman 2021-11-29 12:59 ` Jason Gunthorpe via iommu 2021-11-29 12:59 ` Jason Gunthorpe 2021-11-28 2:50 ` [PATCH v2 05/17] amba: " Lu Baolu 2021-11-28 2:50 ` Lu Baolu 2021-11-28 2:50 ` [PATCH v2 06/17] bus: fsl-mc: " Lu Baolu 2021-11-28 2:50 ` Lu Baolu 2021-11-28 2:50 ` [PATCH v2 07/17] PCI: pci_stub: Suppress kernel DMA ownership auto-claiming Lu Baolu 2021-11-28 2:50 ` Lu Baolu 2021-11-28 2:50 ` [PATCH v2 08/17] PCI: portdrv: " Lu Baolu 2021-11-28 2:50 ` Lu Baolu 2021-11-28 2:50 ` [PATCH v2 09/17] iommu: Add security context management for assigned devices Lu Baolu 2021-11-28 2:50 ` Lu Baolu 2021-11-28 2:50 ` [PATCH v2 10/17] iommu: Expose group variants of dma ownership interfaces Lu Baolu 2021-11-28 2:50 ` Lu Baolu 2021-11-28 2:50 ` [PATCH v2 11/17] iommu: Add iommu_at[de]tach_device_shared() for multi-device groups Lu Baolu 2021-11-28 2:50 ` Lu Baolu 2021-11-28 2:50 ` [PATCH v2 12/17] vfio: Set DMA USER ownership for VFIO devices Lu Baolu 2021-11-28 2:50 ` Lu Baolu 2021-11-28 2:50 ` [PATCH v2 13/17] vfio: Remove use of vfio_group_viable() Lu Baolu 2021-11-28 2:50 ` Lu Baolu 2021-11-28 2:50 ` [PATCH v2 14/17] vfio: Delete the unbound_list Lu Baolu 2021-11-28 2:50 ` Lu Baolu 2021-11-28 2:50 ` [PATCH v2 15/17] vfio: Remove iommu group notifier Lu Baolu 2021-11-28 2:50 ` Lu Baolu 2021-11-28 2:50 ` [PATCH v2 16/17] iommu: Remove iommu group changes notifier Lu Baolu 2021-11-28 2:50 ` Lu Baolu 2021-11-28 2:50 ` [PATCH v2 17/17] drm/tegra: Use the iommu dma_owner mechanism Lu Baolu 2021-11-28 2:50 ` Lu Baolu 2021-11-28 8:10 ` [PATCH v2 00/17] Fix BUG_ON in vfio_iommu_group_notifier() Greg Kroah-Hartman 2021-11-28 8:10 ` Greg Kroah-Hartman 2021-11-29 3:59 ` Lu Baolu 2021-11-29 3:59 ` Lu Baolu 2021-12-06 2:07 ` Lu Baolu 2021-12-06 2:07 ` Lu Baolu
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20211128025051.355578-3-baolu.lu@linux.intel.com \ --to=baolu.lu@linux.intel.com \ --cc=airlied@linux.ie \ --cc=alex.williamson@redhat.com \ --cc=ashok.raj@intel.com \ --cc=bhelgaas@google.com \ --cc=cohuck@redhat.com \ --cc=dan.j.williams@intel.com \ --cc=daniel@ffwll.ch \ --cc=diana.craciun@oss.nxp.com \ --cc=gregkh@linuxfoundation.org \ --cc=hch@infradead.org \ --cc=iommu@lists.linux-foundation.org \ --cc=jacob.jun.pan@intel.com \ --cc=jgg@nvidia.com \ --cc=jonathanh@nvidia.com \ --cc=joro@8bytes.org \ --cc=kch@nvidia.com \ --cc=kevin.tian@intel.com \ --cc=kvm@vger.kernel.org \ --cc=leoyang.li@nxp.com \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-pci@vger.kernel.org \ --cc=rafael@kernel.org \ --cc=robin.murphy@arm.com \ --cc=stuyoder@gmail.com \ --cc=thierry.reding@gmail.com \ --cc=will@kernel.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.