From nobody Fri Jan 2 13:27:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 10D8DCDB473 for ; Wed, 11 Oct 2023 18:15:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235127AbjJKSPU (ORCPT ); Wed, 11 Oct 2023 14:15:20 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47950 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233335AbjJKSPH (ORCPT ); Wed, 11 Oct 2023 14:15:07 -0400 Received: from foss.arm.com (foss.arm.com [217.140.110.172]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id BCB489D for ; Wed, 11 Oct 2023 11:15:05 -0700 (PDT) Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 43AB01516; Wed, 11 Oct 2023 11:15:46 -0700 (PDT) Received: from e121345-lin.cambridge.arm.com (e121345-lin.cambridge.arm.com [10.1.196.40]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPA id A50F23F5A1; Wed, 11 Oct 2023 11:15:04 -0700 (PDT) From: Robin Murphy To: joro@8bytes.org, will@kernel.org Cc: iommu@lists.linux.dev, jgg@nvidia.com, baolu.lu@linux.intel.com, linux-kernel@vger.kernel.org Subject: [PATCH v5 3/7] iommu: Validate that devices match domains Date: Wed, 11 Oct 2023 19:14:50 +0100 Message-Id: <4e8bda33aac4021b444e40389648deccf61c1f37.1697047261.git.robin.murphy@arm.com> X-Mailer: git-send-email 2.39.2.101.g768bb238c484.dirty In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" Before we can allow drivers to coexist, we need to make sure that one driver's domain ops can't misinterpret another driver's dev_iommu_priv data. To that end, add a token to the domain so we can remember how it was allocated - for now this may as well be the device ops, since they still correlate 1:1 with drivers. We can trust ourselves for internal default domain attachment, so add checks to cover all the public attach interfaces. Reviewed-by: Lu Baolu Reviewed-by: Jason Gunthorpe Signed-off-by: Robin Murphy Reviewed-by: Jerry Snitselaar --- v4: Cover iommu_attach_device_pasid() as well, and improve robustness against theoretical attempts to attach a noiommu group. --- drivers/iommu/iommu.c | 10 ++++++++++ include/linux/iommu.h | 1 + 2 files changed, 11 insertions(+) diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c index 7bb92e8b7a49..578292d3b152 100644 --- a/drivers/iommu/iommu.c +++ b/drivers/iommu/iommu.c @@ -2114,6 +2114,7 @@ static struct iommu_domain *__iommu_domain_alloc(cons= t struct iommu_ops *ops, return NULL; =20 domain->type =3D type; + domain->owner =3D ops; /* * If not already set, assume all sizes by default; the driver * may override this later @@ -2279,10 +2280,16 @@ struct iommu_domain *iommu_get_dma_domain(struct de= vice *dev) static int __iommu_attach_group(struct iommu_domain *domain, struct iommu_group *group) { + struct device *dev; + if (group->domain && group->domain !=3D group->default_domain && group->domain !=3D group->blocking_domain) return -EBUSY; =20 + dev =3D iommu_group_first_dev(group); + if (!dev_has_iommu(dev) || dev_iommu_ops(dev) !=3D domain->owner) + return -EINVAL; + return __iommu_group_set_domain(group, domain); } =20 @@ -3480,6 +3487,9 @@ int iommu_attach_device_pasid(struct iommu_domain *do= main, if (!group) return -ENODEV; =20 + if (!dev_has_iommu(dev) || dev_iommu_ops(dev) !=3D domain->owner) + return -EINVAL; + mutex_lock(&group->mutex); curr =3D xa_cmpxchg(&group->pasid_array, pasid, NULL, domain, GFP_KERNEL); if (curr) { diff --git a/include/linux/iommu.h b/include/linux/iommu.h index 2d2802fb2c74..5c9560813d05 100644 --- a/include/linux/iommu.h +++ b/include/linux/iommu.h @@ -99,6 +99,7 @@ struct iommu_domain_geometry { struct iommu_domain { unsigned type; const struct iommu_domain_ops *ops; + const struct iommu_ops *owner; /* Whose domain_alloc we came from */ unsigned long pgsize_bitmap; /* Bitmap of page sizes in use */ struct iommu_domain_geometry geometry; struct iommu_dma_cookie *iova_cookie; --=20 2.39.2.101.g768bb238c484.dirty