This call chain is using dev->iommu->fwspec to pass around the fwspec
between the three parts (of_iommu_configure(), of_iommu_xlate(),
iommu_probe_device()).
However there is no locking around the accesses to dev->iommu, so this is
all racy.
Allocate a clean, local, fwspec at the start of of_iommu_configure(), pass
it through all functions on the stack to fill it with data, and finally
pass it into iommu_probe_device_fwspec() which will load it into
dev->iommu under a lock.
Move the actual call to ops->of_xlate into the core code under
iommu_fwspec_of_xlate().
Reviewed-by: Jerry Snitselaar <jsnitsel@xxxxxxxxxx>
Signed-off-by: Jason Gunthorpe <jgg@xxxxxxxxxx>
---
drivers/iommu/iommu.c | 29 ++++++++++++++
drivers/iommu/of_iommu.c | 82 +++++++++++++++++-----------------------
include/linux/iommu.h | 3 ++
3 files changed, 67 insertions(+), 47 deletions(-)
diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c
index 667495faa461f7..108922829698e9 100644
--- a/drivers/iommu/iommu.c
+++ b/drivers/iommu/iommu.c
@@ -2973,6 +2973,35 @@ static int iommu_fwspec_assign_iommu(struct iommu_fwspec *fwspec,
return 0;
}
+int iommu_fwspec_of_xlate(struct iommu_fwspec *fwspec, struct device *dev,
+ struct fwnode_handle *iommu_fwnode,
+ struct of_phandle_args *iommu_spec)
+{
+ int ret;
+
+ ret = iommu_fwspec_assign_iommu(fwspec, dev, iommu_fwnode);
+ if (ret)
+ return ret;
+
+ if (!fwspec->ops->of_xlate)
+ return -ENODEV;
+
+ if (!dev_iommu_get(dev))
+ return -ENOMEM;
+
+ /*
+ * ops->of_xlate() requires the fwspec to be passed through dev->iommu,
+ * set it temporarily.
+ */
+ if (dev->iommu->fwspec && dev->iommu->fwspec != fwspec)
+ iommu_fwspec_dealloc(dev->iommu->fwspec);
+ dev->iommu->fwspec = fwspec;
+ ret = fwspec->ops->of_xlate(dev, iommu_spec);
+ if (dev->iommu->fwspec == fwspec)
+ dev->iommu->fwspec = NULL;
+ return ret;
+}
+
struct iommu_fwspec *iommu_fwspec_alloc(void)
{
struct iommu_fwspec *fwspec;
diff --git a/drivers/iommu/of_iommu.c b/drivers/iommu/of_iommu.c
index a68a4d1dc0725c..e611cb7455417f 100644
--- a/drivers/iommu/of_iommu.c
+++ b/drivers/iommu/of_iommu.c
@@ -17,40 +17,19 @@
#include <linux/slab.h>
#include <linux/fsl/mc.h>
-static int of_iommu_xlate(struct device *dev,
+static int of_iommu_xlate(struct iommu_fwspec *fwspec, struct device *dev,
struct of_phandle_args *iommu_spec)
{
- const struct iommu_ops *ops;
- struct fwnode_handle *fwnode = &iommu_spec->np->fwnode;
- int ret;
-
- ops = iommu_ops_from_fwnode(fwnode);
- if ((ops && !ops->of_xlate) ||
- !of_device_is_available(iommu_spec->np))
+ if (!of_device_is_available(iommu_spec->np))
return -ENODEV;
- ret = iommu_fwspec_init(dev, &iommu_spec->np->fwnode, ops);
- if (ret)
- return ret;
- /*
- * The otherwise-empty fwspec handily serves to indicate the specific
- * IOMMU device we're waiting for, which will be useful if we ever get
- * a proper probe-ordering dependency mechanism in future.
- */
- if (!ops)
- return driver_deferred_probe_check_state(dev);
-
- if (!try_module_get(ops->owner))
- return -ENODEV;
-
- ret = ops->of_xlate(dev, iommu_spec);
- module_put(ops->owner);
- return ret;
+ return iommu_fwspec_of_xlate(fwspec, dev, &iommu_spec->np->fwnode,
+ iommu_spec);
}
-static int of_iommu_configure_dev_id(struct device_node *master_np,
- struct device *dev,
- const u32 *id)
+static int of_iommu_configure_dev_id(struct iommu_fwspec *fwspec,
+ struct device_node *master_np,
+ struct device *dev, const u32 *id)
{
struct of_phandle_args iommu_spec = { .args_count = 1 };
int err;
@@ -61,12 +40,13 @@ static int of_iommu_configure_dev_id(struct device_node *master_np,
if (err)
return err;
- err = of_iommu_xlate(dev, &iommu_spec);
+ err = of_iommu_xlate(fwspec, dev, &iommu_spec);
of_node_put(iommu_spec.np);
return err;
}
-static int of_iommu_configure_dev(struct device_node *master_np,
+static int of_iommu_configure_dev(struct iommu_fwspec *fwspec,
+ struct device_node *master_np,
struct device *dev)
{
struct of_phandle_args iommu_spec;
@@ -75,7 +55,7 @@ static int of_iommu_configure_dev(struct device_node *master_np,
while (!of_parse_phandle_with_args(master_np, "iommus",
"#iommu-cells",
idx, &iommu_spec)) {
- err = of_iommu_xlate(dev, &iommu_spec);
+ err = of_iommu_xlate(fwspec, dev, &iommu_spec);
of_node_put(iommu_spec.np);
idx++;
if (err)
@@ -88,6 +68,7 @@ static int of_iommu_configure_dev(struct device_node *master_np,
struct of_pci_iommu_alias_info {
struct device *dev;
struct device_node *np;
+ struct iommu_fwspec *fwspec;
};
static int of_pci_iommu_init(struct pci_dev *pdev, u16 alias, void *data)
@@ -95,14 +76,16 @@ static int of_pci_iommu_init(struct pci_dev *pdev, u16 alias, void *data)
struct of_pci_iommu_alias_info *info = data;
u32 input_id = alias;
- return of_iommu_configure_dev_id(info->np, info->dev, &input_id);
+ return of_iommu_configure_dev_id(info->fwspec, info->np, info->dev,
+ &input_id);
}
-static int of_iommu_configure_device(struct device_node *master_np,
+static int of_iommu_configure_device(struct iommu_fwspec *fwspec,
+ struct device_node *master_np,
struct device *dev, const u32 *id)
{
- return (id) ? of_iommu_configure_dev_id(master_np, dev, id) :
- of_iommu_configure_dev(master_np, dev);
+ return (id) ? of_iommu_configure_dev_id(fwspec, master_np, dev, id) :
+ of_iommu_configure_dev(fwspec, master_np, dev);
}
/*
@@ -115,19 +98,15 @@ static int of_iommu_configure_device(struct device_node *master_np,
int of_iommu_configure(struct device *dev, struct device_node *master_np,
const u32 *id)
{
- struct iommu_fwspec *fwspec = dev_iommu_fwspec_get(dev);
+ struct iommu_fwspec *fwspec;
int err;
if (!master_np)
return -ENODEV;
- if (fwspec) {
- if (fwspec->ops)
- return 0;
-
- /* In the deferred case, start again from scratch */
- iommu_fwspec_free(dev);
- }
+ fwspec = iommu_fwspec_alloc();
+ if (IS_ERR(fwspec))
+ return PTR_ERR(fwspec);
/*
* We don't currently walk up the tree looking for a parent IOMMU.
@@ -138,27 +117,36 @@ int of_iommu_configure(struct device *dev, struct device_node *master_np,
struct of_pci_iommu_alias_info info = {
.dev = dev,
.np = master_np,
+ .fwspec = fwspec,
};
pci_request_acs();
err = pci_for_each_dma_alias(to_pci_dev(dev),
of_pci_iommu_init, &info);
} else {
- err = of_iommu_configure_device(master_np, dev, id);
+ err = of_iommu_configure_device(fwspec, master_np, dev, id);
}
if (err == -ENODEV || err == -EPROBE_DEFER)
- return err;
+ goto err_free;
if (err)
goto err_log;
- err = iommu_probe_device(dev);
- if (err)
+ err = iommu_probe_device_fwspec(dev, fwspec);
+ if (err) {
+ /*
+ * Ownership for fwspec always passes into
+ * iommu_probe_device_fwspec()
+ */
+ fwspec = NULL;
goto err_log;
+ }
return 0;
err_log:
dev_dbg(dev, "Adding to IOMMU failed: %pe\n", ERR_PTR(err));
+err_free:
+ iommu_fwspec_dealloc(fwspec);
return err;
}
diff --git a/include/linux/iommu.h b/include/linux/iommu.h
index ca86cd3fe50a82..cea65461eed01c 100644
--- a/include/linux/iommu.h
+++ b/include/linux/iommu.h
@@ -815,6 +815,9 @@ struct iommu_sva {
struct iommu_fwspec *iommu_fwspec_alloc(void);
void iommu_fwspec_dealloc(struct iommu_fwspec *fwspec);
+int iommu_fwspec_of_xlate(struct iommu_fwspec *fwspec, struct device *dev,
+ struct fwnode_handle *iommu_fwnode,
+ struct of_phandle_args *iommu_spec);
int iommu_fwspec_init(struct device *dev, struct fwnode_handle *iommu_fwnode,
const struct iommu_ops *ops);
--
2.42.0
