s390/vfio_ccw: Ensure first IDAW remains constant

The first IDAW in a list does not need to be on a 2K/4K boundary
like all others, and so is read separately to accurately calculate
the size of the buffer needed to read the full IDAL.

Verify that the address found in the first IDAW is unchanged between
reads, to ensure a consistent set of IDAWs being worked with.

Fixes: 01aa26c672c0 ("s390/cio: Combine direct and indirect CCW paths")
Cc: stable@vger.kernel.org
Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com>
Signed-off-by: Eric Farman <farman@linux.ibm.com>
Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>

diff --git a/drivers/s390/cio/vfio_ccw_cp.c b/drivers/s390/cio/vfio_ccw_cp.c
index af632f9d545356921d229e4248354ca15718837e..6275794751cb456f12726be5661e949592a54198 100644 (file)
--- a/drivers/s390/cio/vfio_ccw_cp.c
+++ b/drivers/s390/cio/vfio_ccw_cp.c
@@ -523,6 +523,7 @@ static dma64_t *get_guest_idal(struct ccw1 *ccw, struct channel_program *cp, int
                &container_of(cp, struct vfio_ccw_private, cp)->vdev;
        dma64_t *idaws;
        dma32_t *idaws_f1;
+       u64 first_idaw;
        int idal_len = idaw_nr * sizeof(*idaws);
        int idaw_size = idal_is_2k(cp) ? PAGE_SIZE / 2 : PAGE_SIZE;
        int idaw_mask = ~(idaw_size - 1);
@@ -539,6 +540,18 @@ static dma64_t *get_guest_idal(struct ccw1 *ccw, struct channel_program *cp, int
                        kfree(idaws);
                        return ERR_PTR(ret);
                }
+
+               idaws_f1 = (dma32_t *)idaws;
+               if (cp->orb.cmd.c64)
+                       first_idaw = dma64_to_u64(idaws[0]);
+               else
+                       first_idaw = dma32_to_u32(idaws_f1[0]);
+
+               /* Unexpected mismatch from earlier read */
+               if (first_idaw != cp->guest_iova) {
+                       kfree(idaws);
+                       return ERR_PTR(-EINVAL);
+               }
        } else {
                /* Fabricate an IDAL based off CCW data address */
                if (cp->orb.cmd.c64) {
@@ -604,6 +617,9 @@ static int ccw_count_idaws(struct ccw1 *ccw,
                iova = dma32_to_u32(ccw->cda);
        }
 
+       /* Save the read address for later */
+       cp->guest_iova = iova;
+
        /* Format-1 IDAWs operate on 2K each */
        if (!cp->orb.cmd.c64)
                return idal_2k_nr_words((void *)iova, bytes);

diff --git a/drivers/s390/cio/vfio_ccw_cp.h b/drivers/s390/cio/vfio_ccw_cp.h
index a9b1d8dbc6f655e712cf658172af2dc76e6d6296..9af98ff12d671623e5087106559b1f019880cb1c 100644 (file)
--- a/drivers/s390/cio/vfio_ccw_cp.h
+++ b/drivers/s390/cio/vfio_ccw_cp.h
@@ -35,6 +35,7 @@
  * @initialized: whether this instance is actually initialized
  * @guest_cp: copy of guest channel program
  * @ccwchain_count: number of channel program segments (linked by TIC)
+ * @guest_iova: first data address of a guest channel program
  *
  * @ccwchain_list is the head of a ccwchain list, that contents the
  * translated result of the guest channel program that pointed out by
@@ -46,6 +47,7 @@ struct channel_program {
        bool initialized;
        struct ccw1 *guest_cp;
        unsigned int ccwchain_count;
+       u64 guest_iova;
 };
 
 int cp_init(struct channel_program *cp, union orb *orb);