search for: arm_smmu_device_group

.../ > for_each_cfg_sme(cfg, fwspec, i, idx) { > arm_smmu_write_sme(smmu, idx); > - smmu->s2crs[idx].group = group; > + smmu->s2crs[idx].dev = dev; > } > > mutex_unlock(&smmu->stream_map_mutex); > @@ -1495,11 +1495,15 @@ static struct iommu_group *arm_smmu_device_group(struct device *dev) > int i, idx; > > for_each_cfg_sme(cfg, fwspec, i, idx) { > - if (group && smmu->s2crs[idx].group && > - group != smmu->s2crs[idx].group) > + struct iommu_group *idx_grp = NULL; > + > + if (smmu->s2crs[idx].dev) &...

.../ > for_each_cfg_sme(cfg, fwspec, i, idx) { > arm_smmu_write_sme(smmu, idx); > - smmu->s2crs[idx].group = group; > + smmu->s2crs[idx].dev = dev; > } > > mutex_unlock(&smmu->stream_map_mutex); > @@ -1495,11 +1495,15 @@ static struct iommu_group *arm_smmu_device_group(struct device *dev) > int i, idx; > > for_each_cfg_sme(cfg, fwspec, i, idx) { > - if (group && smmu->s2crs[idx].group && > - group != smmu->s2crs[idx].group) > + struct iommu_group *idx_grp = NULL; > + > + if (smmu->s2crs[idx].dev) &...

...gt; use-after-free of A >> >> Preserving the logical behaviour here would probably look *something* like >> the mangled diff below, but I haven't thought it through 100%. > > Yeah, I think you are right. How about just moving the loop which sets > s2crs[idx].group to arm_smmu_device_group()? In that case I can drop > this patch and leave the group pointer in place. Isn't that exactly what I suggested? :) I don't recall for sure, but knowing me, that bit of group bookkeeping is only where it currently is because it cheekily saves iterating the IDs a second time. I don&...

...ll = arm_smmu_flush_iotlb_all, .iotlb_sync = arm_smmu_iotlb_sync, .iova_to_phys = arm_smmu_iova_to_phys, - .add_device = arm_smmu_add_device, - .remove_device = arm_smmu_remove_device, + .probe_device = arm_smmu_probe_device, + .release_device = arm_smmu_release_device, .device_group = arm_smmu_device_group, .domain_get_attr = arm_smmu_domain_get_attr, .domain_set_attr = arm_smmu_domain_set_attr, diff --git a/drivers/iommu/arm-smmu.c b/drivers/iommu/arm-smmu.c index a6a5796e9c41..e622f4e33379 100644 --- a/drivers/iommu/arm-smmu.c +++ b/drivers/iommu/arm-smmu.c @@ -220,7 +220,7 @@ static int arm_sm...

.../* It worked! Now, poke the actual hardware */ for_each_cfg_sme(cfg, fwspec, i, idx) { arm_smmu_write_sme(smmu, idx); - smmu->s2crs[idx].group = group; + smmu->s2crs[idx].dev = dev; } mutex_unlock(&smmu->stream_map_mutex); @@ -1495,11 +1495,15 @@ static struct iommu_group *arm_smmu_device_group(struct device *dev) int i, idx; for_each_cfg_sme(cfg, fwspec, i, idx) { - if (group && smmu->s2crs[idx].group && - group != smmu->s2crs[idx].group) + struct iommu_group *idx_grp = NULL; + + if (smmu->s2crs[idx].dev) + idx_grp = smmu->s2crs[idx].dev->io...

...iommu_device_group(C) -> use-after-free of A > > Preserving the logical behaviour here would probably look *something* like > the mangled diff below, but I haven't thought it through 100%. Yeah, I think you are right. How about just moving the loop which sets s2crs[idx].group to arm_smmu_device_group()? In that case I can drop this patch and leave the group pointer in place. Regards, Joerg

Hi, here is a patch-set to remove all calls of iommu_group_get_for_dev() from the IOMMU drivers and move the per-device group setup and default domain allocation into the IOMMU core code. This eliminates some ugly back and forth between IOMMU core code and the IOMMU drivers, where the driver called iommu_group_get_for_dev() which itself called back into the driver. The patch-set started as a

Hi, here is a patch-set to remove all calls of iommu_group_get_for_dev() from the IOMMU drivers and move the per-device group setup and default domain allocation into the IOMMU core code. This eliminates some ugly back and forth between IOMMU core code and the IOMMU drivers, where the driver called iommu_group_get_for_dev() which itself called back into the driver. The patch-set started as a

Hi, here is the second version of this patch-set. The first version with some more introductory text can be found here: https://lore.kernel.org/lkml/20200407183742.4344-1-joro at 8bytes.org/ Changes v1->v2: * Rebased to v5.7-rc1 * Re-wrote the arm-smmu changes as suggested by Robin Murphy * Re-worked the Exynos patches to hopefully not break the driver anymore * Fixed a missing

Hi, here is the second version of this patch-set. The first version with some more introductory text can be found here: https://lore.kernel.org/lkml/20200407183742.4344-1-joro at 8bytes.org/ Changes v1->v2: * Rebased to v5.7-rc1 * Re-wrote the arm-smmu changes as suggested by Robin Murphy * Re-worked the Exynos patches to hopefully not break the driver anymore * Fixed a missing

Hi, here is the third version of this patch-set. Older versions can be found here: v1: https://lore.kernel.org/lkml/20200407183742.4344-1-joro at 8bytes.org/ (Has some more introductory text) v2: https://lore.kernel.org/lkml/20200414131542.25608-1-joro at 8bytes.org/ Changes v2 -> v3: * Rebased v5.7-rc3 * Added a missing iommu_group_put() as reported by Lu Baolu. * Added a

Hi, here is a patch-set to rename iommu_param to dev_iommu and establish it as a struct for generic per-device iommu-data. Also move the iommu_fwspec pointer from struct device into dev_iommu to have less iommu-related pointers in struct device. The bigger part of this patch-set moves the iommu_priv pointer from struct iommu_fwspec to dev_iommu, making is usable for iommu-drivers which do not