From patchwork Mon Feb 27 19:54:41 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jean-Philippe Brucker X-Patchwork-Id: 9594119 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 8DA2C60453 for ; Mon, 27 Feb 2017 20:32:50 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 7FDF920453 for ; Mon, 27 Feb 2017 20:32:50 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 74002204C2; Mon, 27 Feb 2017 20:32:50 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-1.9 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID autolearn=unavailable version=3.3.1 Received: from bombadil.infradead.org (bombadil.infradead.org [65.50.211.133]) (using TLSv1.2 with cipher AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 171DC20453 for ; Mon, 27 Feb 2017 20:32:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20170209; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:Cc:List-Subscribe: List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:References: In-Reply-To:Message-Id:Date:Subject:To:From:Reply-To:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Owner; bh=DeEC6RCBCgiXNWrzZAeFQdZ5B4jlyGoad3/7h21NV5k=; b=YUQgFg50/kU95l4PIBc6d6sLe1 O6ZeBetA92XJFFH7A37+4rShLBKiIjLa63FdSFh4GP8IhBWREGkTZDbfMCAeDkpueuPzyLV1JaGrx SOYfM3RvkvCDwILIW75ohOgsFRXRFlncNF0QLB/IeC1NsGPBtxWZiMyjASV/2/a5J10MKSDu5IxxO EblYagoOJh0ye0ZCYDhY/HtXw3ZEGP8fbjEETjaJ49V8QOcNtfEDsNgm5fe8nKoekTGs0YjFUGHeL MZVH3SgbYRPhP/JRxQmpXZL62YZnwBYYSYZTVLbf60haG7xtMf6gjsi3qj59GV13prdeTzXi8o5GQ tvKnIYPQ==; Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.87 #1 (Red Hat Linux)) id 1ciRyO-0007WN-5K; Mon, 27 Feb 2017 20:32:44 +0000 Received: from merlin.infradead.org ([2001:4978:20e::2]) by bombadil.infradead.org with esmtps (Exim 4.87 #1 (Red Hat Linux)) id 1ciRvW-0004kN-Qf for linux-arm-kernel@bombadil.infradead.org; Mon, 27 Feb 2017 20:29:46 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=infradead.org; s=merlin.20170209; h=References:In-Reply-To:Message-Id:Date: Subject:Cc:To:From:Sender:Reply-To:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=aItiqj5KP7FOwlCT52hRt/mbujDFrf4V6wnfQDMswJY=; b=1Dn57rgYy/NLmiUzIPOYAeePB 27vkor9v29oG9IC/LfUiz6ngGeVjGzhjJub+VEQfUQFvPWdivJf3IuWo2hFm7tt+UxSUoXw1iT+hC /sVgxP4M/jcmRnCzVW1AhuoiPC+zsOPGAX0CYc+ABUgUPvp3p2PLF2HUkaK9PnAdV0o6cDFM/3iGJ /tmHjJI7IvUx50f1BGhuGyDa80nbs1Zzi34u0hh/jtH0iLfnbcLWyiVbgkEqEMcch4Bmb859qsWAU fmZa5ZBroPc4ODB1V30lK1TT/ftjDLZLgRUMYCqf/GBuZoPVP0qji81BsmSknllVpA2BDllTmMfJt Y+L//0hEw==; Received: from foss.arm.com ([217.140.101.70]) by merlin.infradead.org with esmtp (Exim 4.87 #1 (Red Hat Linux)) id 1ciRSX-0007C5-0u for linux-arm-kernel@lists.infradead.org; Mon, 27 Feb 2017 19:59:49 +0000 Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.72.51.249]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 161D119BF; Mon, 27 Feb 2017 11:59:31 -0800 (PST) Received: from e106794-lin.cambridge.arm.com (e106794-lin.cambridge.arm.com [10.1.210.60]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPA id 6B04B3F3E1; Mon, 27 Feb 2017 11:59:28 -0800 (PST) From: Jean-Philippe Brucker To: Subject: [RFC PATCH 30/30] vfio: Allow to bind foreign task Date: Mon, 27 Feb 2017 19:54:41 +0000 Message-Id: <20170227195441.5170-31-jean-philippe.brucker@arm.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20170227195441.5170-1-jean-philippe.brucker@arm.com> References: <20170227195441.5170-1-jean-philippe.brucker@arm.com> X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20170227_145949_249296_83E96700 X-CRM114-Status: GOOD ( 17.89 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Lorenzo Pieralisi , Shanker Donthineni , kvm@vger.kernel.org, Catalin Marinas , Joerg Roedel , Sinan Kaya , Will Deacon , iommu@lists.linux-foundation.org, Harv Abdulhamid , Alex Williamson , linux-pci@vger.kernel.org, Bjorn Helgaas , Robin Murphy , David Woodhouse , linux-arm-kernel@lists.infradead.org, Nate Watterson MIME-Version: 1.0 Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+patchwork-linux-arm=patchwork.kernel.org@lists.infradead.org X-Virus-Scanned: ClamAV using ClamSMTP Let the process that owns the device create an address space bond on behalf of another process. We add a pid argument to the BIND_TASK ioctl, allowing the caller to bind a foreign task. The expected program flow in this case is: * Process A creates the VFIO context and initializes the device. * Process B asks A to bind its address space. * Process A issues an ioctl to the VFIO device fd with BIND_TASK(pid). It may communicate the given PASID back to process B or keep track of it internally. * Process B asks A to perform transactions on its virtual address. * Process A launches transaction tagged with the given PASID. Signed-off-by: Jean-Philippe Brucker --- drivers/vfio/vfio.c | 35 +++++++++++++++++++++++++++++++++-- include/uapi/linux/vfio.h | 15 +++++++++++++++ 2 files changed, 48 insertions(+), 2 deletions(-) diff --git a/drivers/vfio/vfio.c b/drivers/vfio/vfio.c index c4505d8f4c61..ecc5d07e3dbb 100644 --- a/drivers/vfio/vfio.c +++ b/drivers/vfio/vfio.c @@ -26,6 +26,7 @@ #include #include #include +#include #include #include #include @@ -1660,7 +1661,7 @@ static long vfio_svm_ioctl(struct vfio_device *device, unsigned int cmd, struct vfio_device_svm svm; struct vfio_task *vfio_task; - minsz = offsetofend(struct vfio_device_svm, pasid); + minsz = offsetofend(struct vfio_device_svm, pid); if (copy_from_user(&svm, (void __user *)arg, minsz)) return -EFAULT; @@ -1669,9 +1670,39 @@ static long vfio_svm_ioctl(struct vfio_device *device, unsigned int cmd, return -EINVAL; if (cmd == VFIO_DEVICE_BIND_TASK) { - struct task_struct *task = current; + struct mm_struct *mm; + struct task_struct *task; + + if (svm.flags & ~VFIO_SVM_PID) + return -EINVAL; + + if (svm.flags & VFIO_SVM_PID) { + rcu_read_lock(); + task = find_task_by_vpid(svm.pid); + if (task) + get_task_struct(task); + rcu_read_unlock(); + if (!task) + return -ESRCH; + + /* + * Ensure process has RW access on the task's mm + * FIXME: + * - I think this ought to be in the IOMMU API + * - I'm assuming permission is never revoked during the + * task's lifetime. Might be mistaken. + */ + mm = mm_access(task, PTRACE_MODE_ATTACH_REALCREDS); + if (!mm || IS_ERR(mm)) + return IS_ERR(mm) ? PTR_ERR(mm) : -ESRCH; + mmput(mm); + } else { + get_task_struct(current); + task = current; + } ret = iommu_bind_task(device->dev, task, &svm.pasid, 0, NULL); + put_task_struct(task); if (ret) return ret; diff --git a/include/uapi/linux/vfio.h b/include/uapi/linux/vfio.h index 3fe4197a5ea0..41ae8a231d42 100644 --- a/include/uapi/linux/vfio.h +++ b/include/uapi/linux/vfio.h @@ -415,7 +415,9 @@ struct vfio_device_svm { __u32 flags; #define VFIO_SVM_PASID_RELEASE_FLUSHED (1 << 0) #define VFIO_SVM_PASID_RELEASE_CLEAN (1 << 1) +#define VFIO_SVM_PID (1 << 2) __u32 pasid; + __u32 pid; }; /* * VFIO_DEVICE_BIND_TASK - _IOWR(VFIO_TYPE, VFIO_BASE + 22, @@ -432,6 +434,19 @@ struct vfio_device_svm { * On success, VFIO writes a Process Address Space ID (PASID) into @pasid. This * ID is unique to a device. * + * VFIO_SVM_PID: bind task @pid instead of current task. The shared address + * space identified by @pasid is that of task identified by @pid. + * + * Given that the caller owns the device, setting this flag grants the + * caller read and write permissions on the entire address space of + * foreign task described by @pid. Therefore, permission to perform the + * bind operation on a foreign process is governed by the ptrace access + * mode PTRACE_MODE_ATTACH_REALCREDS check. See man ptrace(2) for more + * information. + * + * If the VFIO_SVM_PID flag is not set, @pid is unused and it is the + * current task that is bound to the device. + * * The bond between device and process must be removed with * VFIO_DEVICE_UNBIND_TASK before exiting. *