[PATCH RFC v8 8/9] iommu/arm-smmu-v3: Serialize shared-SID changes with attach

["Peng Fan (OSS)" <peng.fan@oss.nxp.com>]

From: Peng Fan <peng.fan@nxp.com>

Shared SID membership is modified under smmu->streams_mutex, but the
attach, PASID, ATS and vSMMU paths read it while holding the group mutex
or arm_smmu_asid_lock. A second device can start sharing a SID while the
first master is attaching, so the first master may select a private CD
table or enable a feature that is incompatible with sharing.

Take arm_smmu_asid_lock around insert_master() and remove_master() so
sharing changes serialize with the attach/PASID/ATS paths, which already
hold it. Keep the lock order asid_lock -> streams_mutex.

Recheck shared membership under asid_lock in the PASID attach path and
move the vSMMU membership checks under asid_lock. The incoming master's
own probe setup is still serialized by iommu_probe_device_lock.

Signed-off-by: Peng Fan <peng.fan@nxp.com>
---
 .../iommu/arm/arm-smmu-v3/arm-smmu-v3-iommufd.c    | 27 +++++++++++++++++-----
 drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c        | 14 +++++++++++
 drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c     |  9 +++++++-
 3 files changed, 43 insertions(+), 7 deletions(-)

diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-iommufd.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-iommufd.c
index 1fa512a655d2..10c5f9605152 100644
--- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-iommufd.c
+++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-iommufd.c
@@ -168,12 +168,16 @@ static int arm_smmu_attach_dev_nested(struct iommu_domain *domain,
 
 	if (nested_domain->vsmmu->smmu != master->smmu)
 		return -EINVAL;
-	if (arm_smmu_master_shares_sid(master))
-		return -EOPNOTSUPP;
-	if (arm_smmu_ssids_in_use(&master->cd_table))
-		return -EBUSY;
 
 	mutex_lock(&arm_smmu_asid_lock);
+	if (arm_smmu_master_shares_sid(master)) {
+		mutex_unlock(&arm_smmu_asid_lock);
+		return -EOPNOTSUPP;
+	}
+	if (arm_smmu_ssids_in_use(&master->cd_table)) {
+		mutex_unlock(&arm_smmu_asid_lock);
+		return -EBUSY;
+	}
 	/*
 	 * The VM has to control the actual ATS state at the PCI device because
 	 * we forward the invalidations directly from the VM. If the VM doesn't
@@ -312,8 +316,15 @@ static int arm_vsmmu_vdevice_init(struct iommufd_vdevice *vdev)
 	 * arm_vsmmu_vsid_to_sid() maps a vSID to master->streams[0] alone, so
 	 * more streams would leave the rest stale and none reads out of bounds.
 	 */
-	if (master->num_streams != 1 || arm_smmu_master_shares_sid(master))
+	if (master->num_streams != 1)
+		return -EOPNOTSUPP;
+
+	mutex_lock(&arm_smmu_asid_lock);
+	if (arm_smmu_master_shares_sid(master)) {
+		mutex_unlock(&arm_smmu_asid_lock);
 		return -EOPNOTSUPP;
+	}
+	mutex_unlock(&arm_smmu_asid_lock);
 	return 0;
 }
 
@@ -547,8 +558,12 @@ size_t arm_smmu_get_viommu_size(struct device *dev,
 	struct arm_smmu_master *master = dev_iommu_priv_get(dev);
 	struct arm_smmu_device *smmu = master->smmu;
 
-	if (arm_smmu_master_shares_sid(master))
+	mutex_lock(&arm_smmu_asid_lock);
+	if (arm_smmu_master_shares_sid(master)) {
+		mutex_unlock(&arm_smmu_asid_lock);
 		return 0;
+	}
+	mutex_unlock(&arm_smmu_asid_lock);
 
 	if (!(smmu->features & ARM_SMMU_FEAT_NESTING))
 		return 0;
diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
index 790a6e54c24a..5a6bed0ca7f1 100644
--- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
+++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
@@ -4114,6 +4114,11 @@ int arm_smmu_set_pasid(struct arm_smmu_master *master,
 	}
 
 	mutex_lock(&arm_smmu_asid_lock);
+	if (arm_smmu_master_shares_sid(master)) {
+		mutex_unlock(&arm_smmu_asid_lock);
+		return -EOPNOTSUPP;
+	}
+
 	ret = arm_smmu_attach_prepare(&state, &smmu_domain->domain);
 	if (ret) {
 		mutex_unlock(&arm_smmu_asid_lock);
@@ -4588,6 +4593,11 @@ static int arm_smmu_insert_master(struct arm_smmu_device *smmu,
 	}
 	INIT_LIST_HEAD(&master->shared_masters_elm);
 
+	/*
+	 * Serialize sharing changes with attach/PASID/ATS updates, which
+	 * hold arm_smmu_asid_lock. Lock order is asid_lock -> streams_mutex.
+	 */
+	mutex_lock(&arm_smmu_asid_lock);
 	mutex_lock(&smmu->streams_mutex);
 	for (i = 0, n = 0; i < fwspec->num_ids; i++) {
 		struct arm_smmu_stream *stream;
@@ -4678,11 +4688,13 @@ static int arm_smmu_insert_master(struct arm_smmu_device *smmu,
 	if (ret) {
 		arm_smmu_free_master_streams(master);
 		mutex_unlock(&smmu->streams_mutex);
+		mutex_unlock(&arm_smmu_asid_lock);
 		kfree(master->streams);
 		kfree(master->build_invs);
 		return ret;
 	}
 	mutex_unlock(&smmu->streams_mutex);
+	mutex_unlock(&arm_smmu_asid_lock);
 
 	/* Put the ids into order for sorted to_merge/to_unref arrays */
 	sort(master->streams, master->num_streams,
@@ -4699,9 +4711,11 @@ static void arm_smmu_remove_master(struct arm_smmu_master *master)
 	if (!smmu || !master->streams)
 		return;
 
+	mutex_lock(&arm_smmu_asid_lock);
 	mutex_lock(&smmu->streams_mutex);
 	arm_smmu_free_master_streams(master);
 	mutex_unlock(&smmu->streams_mutex);
+	mutex_unlock(&arm_smmu_asid_lock);
 
 	kfree(master->streams);
 	kfree(master->build_invs);
diff --git a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c b/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c
index ffb0ac93a4f4..3bcecdc00a86 100644
--- a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c
+++ b/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c
@@ -1264,9 +1264,16 @@ static int tegra241_vintf_init_vsid(struct iommufd_vdevice *vdev)
 	if (virt_sid > FIELD_MAX(VINTF_SID_MATCH_VIRT_SID))
 		return -EINVAL;
 
-	if (master->num_streams != 1 || arm_smmu_master_shares_sid(master))
+	if (master->num_streams != 1)
 		return -EOPNOTSUPP;
 
+	mutex_lock(&arm_smmu_asid_lock);
+	if (arm_smmu_master_shares_sid(master)) {
+		mutex_unlock(&arm_smmu_asid_lock);
+		return -EOPNOTSUPP;
+	}
+	mutex_unlock(&arm_smmu_asid_lock);
+
 	/* Find an empty pair of SID_REPLACE and SID_MATCH */
 	sidx = ida_alloc_max(&vintf->sids, vintf->cmdqv->num_sids_per_vintf - 1,
 			     GFP_KERNEL);

-- 
2.34.1