Merge tag 'iommu-fixes-v4.9-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu

Pull IOMMU fixes from Joerg Roedel:

 - Four patches from Robin Murphy fix several issues with the recently
   merged generic DT-bindings support for arm-smmu drivers

 - A fix for a dead-lock issue in the VT-d driver, which shows up on
   iommu hotplug

* tag 'iommu-fixes-v4.9-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu:
  iommu/vt-d: Fix dead-locks in disable_dmar_iommu() path
  iommu/arm-smmu: Fix out-of-bounds dereference
  iommu/arm-smmu: Check that iommu_fwspecs are ours
  iommu/arm-smmu: Don't inadvertently reject multiple SMMUv3s
  iommu/arm-smmu: Work around ARM DMA configuration

3 files changed, 43 insertions, 12 deletions

diff --git a/drivers/iommu/arm-smmu-v3.c b/drivers/iommu/arm-smmu-v3.c
index 15c01c3cd540..e6f9b2d745ca 100644
--- a/drivers/iommu/arm-smmu-v3.c
+++ b/drivers/iommu/arm-smmu-v3.c
@@ -2636,17 +2636,26 @@ static int arm_smmu_device_dt_probe(struct platform_device *pdev)
         /* And we're up. Go go go! */
         of_iommu_set_ops(dev->of_node, &arm_smmu_ops);
 #ifdef CONFIG_PCI
-        pci_request_acs();
-        ret = bus_set_iommu(&pci_bus_type, &arm_smmu_ops);
-        if (ret)
-                return ret;
+        if (pci_bus_type.iommu_ops != &arm_smmu_ops) {
+                pci_request_acs();
+                ret = bus_set_iommu(&pci_bus_type, &arm_smmu_ops);
+                if (ret)
+                        return ret;
+        }
 #endif
 #ifdef CONFIG_ARM_AMBA
-        ret = bus_set_iommu(&amba_bustype, &arm_smmu_ops);
-        if (ret)
-                return ret;
+        if (amba_bustype.iommu_ops != &arm_smmu_ops) {
+                ret = bus_set_iommu(&amba_bustype, &arm_smmu_ops);
+                if (ret)
+                        return ret;
+        }
 #endif
-        return bus_set_iommu(&platform_bus_type, &arm_smmu_ops);
+        if (platform_bus_type.iommu_ops != &arm_smmu_ops) {
+                ret = bus_set_iommu(&platform_bus_type, &arm_smmu_ops);
+                if (ret)
+                        return ret;
+        }
+        return 0;
 }
 
 static int arm_smmu_device_remove(struct platform_device *pdev)
diff --git a/drivers/iommu/arm-smmu.c b/drivers/iommu/arm-smmu.c
index c841eb7a1a74..8f7281444551 100644
--- a/drivers/iommu/arm-smmu.c
+++ b/drivers/iommu/arm-smmu.c
@@ -324,8 +324,10 @@ struct arm_smmu_master_cfg {
 #define INVALID_SMENDX                  -1
 #define __fwspec_cfg(fw) ((struct arm_smmu_master_cfg *)fw->iommu_priv)
 #define fwspec_smmu(fw)  (__fwspec_cfg(fw)->smmu)
+#define fwspec_smendx(fw, i) \
+        (i >= fw->num_ids ? INVALID_SMENDX : __fwspec_cfg(fw)->smendx[i])
 #define for_each_cfg_sme(fw, i, idx) \
-        for (i = 0; idx = __fwspec_cfg(fw)->smendx[i], i < fw->num_ids; ++i)
+        for (i = 0; idx = fwspec_smendx(fw, i), i < fw->num_ids; ++i)
 
 struct arm_smmu_device {
         struct device                   *dev;
@@ -1228,6 +1230,16 @@ static int arm_smmu_attach_dev(struct iommu_domain *domain, struct device *dev)
                 return -ENXIO;
         }
 
+        /*
+         * FIXME: The arch/arm DMA API code tries to attach devices to its own
+         * domains between of_xlate() and add_device() - we have no way to cope
+         * with that, so until ARM gets converted to rely on groups and default
+         * domains, just say no (but more politely than by dereferencing NULL).
+         * This should be at least a WARN_ON once that's sorted.
+         */
+        if (!fwspec->iommu_priv)
+                return -ENODEV;
+
         smmu = fwspec_smmu(fwspec);
         /* Ensure that the domain is finalised */
         ret = arm_smmu_init_domain_context(domain, smmu);
@@ -1390,7 +1402,7 @@ static int arm_smmu_add_device(struct device *dev)
                 fwspec = dev->iommu_fwspec;
                 if (ret)
                         goto out_free;
-        } else if (fwspec) {
+        } else if (fwspec && fwspec->ops == &arm_smmu_ops) {
                 smmu = arm_smmu_get_by_node(to_of_node(fwspec->iommu_fwnode));
         } else {
                 return -ENODEV;
diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index a4407eabf0e6..3965e73db51c 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -1711,6 +1711,7 @@ static void disable_dmar_iommu(struct intel_iommu *iommu)
         if (!iommu->domains || !iommu->domain_ids)
                 return;
 
+again:
         spin_lock_irqsave(&device_domain_lock, flags);
         list_for_each_entry_safe(info, tmp, &device_domain_list, global) {
                 struct dmar_domain *domain;
@@ -1723,10 +1724,19 @@ static void disable_dmar_iommu(struct intel_iommu *iommu)
 
                 domain = info->domain;
 
-                dmar_remove_one_dev_info(domain, info->dev);
+                __dmar_remove_one_dev_info(info);
 
-                if (!domain_type_is_vm_or_si(domain))
+                if (!domain_type_is_vm_or_si(domain)) {
+                        /*
+                         * The domain_exit() function  can't be called under
+                         * device_domain_lock, as it takes this lock itself.
+                         * So release the lock here and re-run the loop
+                         * afterwards.
+                         */
+                        spin_unlock_irqrestore(&device_domain_lock, flags);
                         domain_exit(domain);
+                        goto again;
+                }
         }
         spin_unlock_irqrestore(&device_domain_lock, flags);