On Fri, Jul 28, 2023 at 03:02:43PM -0300, Jason Gunthorpe wrote:
> > +int iommufd_hwpt_invalidate(struct iommufd_ucmd *ucmd)
> > +{
> > + struct iommu_hwpt_invalidate *cmd = ucmd->cmd;
> > + struct iommufd_hw_pagetable *hwpt;
> > + u32 user_data_len, klen;
> > + u64 user_ptr;
> > + int rc = 0;
> > +
> > + if (!cmd->data_len || cmd->__reserved)
> > + return -EOPNOTSUPP;
> > +
> > + hwpt = iommufd_get_hwpt(ucmd, cmd->hwpt_id);
> > + if (IS_ERR(hwpt))
> > + return PTR_ERR(hwpt);
> > +
> > + /* Do not allow any kernel-managed hw_pagetable */
> > + if (!hwpt->parent) {
>
> I don't think this is needed because:
>
> > + rc = -EINVAL;
> > + goto out_put_hwpt;
> > + }
> > +
> > + klen = hwpt->domain->ops->cache_invalidate_user_data_len;
> > + if (!hwpt->domain->ops->cache_invalidate_user || !klen) {
> > + rc = -EOPNOTSUPP;
>
> We need to get to a place where the drivers are providing proper ops
> for the domains, so this op should never exist for a paging domain.
>
> And return EINVAL here instead.
Fixed those two above and added the following in alloc():
-------------------------------------------------------------------------------
diff --git a/drivers/iommu/iommufd/hw_pagetable.c b/drivers/iommu/iommufd/hw_pagetable.c
index 08aa4debc58a..7ddeda22ac62 100644
--- a/drivers/iommu/iommufd/hw_pagetable.c
+++ b/drivers/iommu/iommufd/hw_pagetable.c
@@ -123,6 +123,12 @@ iommufd_hw_pagetable_alloc(struct iommufd_ctx *ictx,
rc = -EINVAL;
goto out_abort;
}
+ /* Driver is buggy by mixing user-managed ops in kernel-managed ops */
+ if (WARN_ON_ONCE(hwpt->domain->ops->cache_invalidate_user ||
+ hwpt->domain->ops->cache_invalidate_user_data_len)) {
+ rc = -EINVAL;
+ goto out_abort;
+ }
/*
* Set the coherency mode before we do iopt_table_add_domain() as some
-------------------------------------------------------------------------------
Thanks
Nic
