[PATCH] iommufd/selftest: Add missing driver_ops for AMDV1 mock domain

[PATCH] iommufd/selftest: Add missing driver_ops for AMDV1 mock domain

[Pranjal Shrivastava]

syzbot found that allocating a mock domain with AMDV1 format could
cause a WARN_ON because the selftest enabled DYNAMIC_TOP without
providing the required driver_ops.

Initialize a spinlock (top_lock) and dummy callbacks in the mock
driver to satisfy the generic PT requirements.

Fixes: dcd6a011a8d5 ("iommupt: Add map_pages op")
Reported-by: syzbot+453eb7add07c3767adab@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/69c1d50b.a70a0220.3cae05.0001.GAE@google.com/
Signed-off-by: Pranjal Shrivastava <praan@google.com>
---
 drivers/iommu/iommufd/selftest.c | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/drivers/iommu/iommufd/selftest.c b/drivers/iommu/iommufd/selftest.c
index 9607416f8069..960c5aee4a09 100644
--- a/drivers/iommu/iommufd/selftest.c
+++ b/drivers/iommu/iommufd/selftest.c
@@ -119,6 +119,7 @@ struct mock_iommu_domain {
 		struct pt_iommu_amdv1 amdv1;
 	};
 	unsigned long flags;
+	spinlock_t top_lock;
 };
 PT_IOMMU_CHECK_DOMAIN(struct mock_iommu_domain, iommu, domain);
 PT_IOMMU_CHECK_DOMAIN(struct mock_iommu_domain, amdv1.iommu, domain);
@@ -129,6 +130,26 @@ to_mock_domain(struct iommu_domain *domain)
 	return container_of(domain, struct mock_iommu_domain, domain);
 }
 
+static void mock_domain_change_top(struct pt_iommu *iommu_table,
+				   phys_addr_t top_paddr,
+				   unsigned int top_level)
+{
+	/* The selftest doesn't have real hardware */
+}
+
+static spinlock_t *mock_domain_get_top_lock(struct pt_iommu *iommu_table)
+{
+	struct mock_iommu_domain *mock =
+		container_of(iommu_table, struct mock_iommu_domain, iommu);
+
+	return &mock->top_lock;
+}
+
+static const struct pt_iommu_driver_ops mock_driver_ops = {
+	.change_top = &mock_domain_change_top,
+	.get_top_lock = &mock_domain_get_top_lock,
+};
+
 struct mock_iommu_domain_nested {
 	struct iommu_domain domain;
 	struct mock_viommu *mock_viommu;
@@ -445,6 +466,8 @@ mock_domain_alloc_pgtable(struct device *dev,
 	if (!mock)
 		return ERR_PTR(-ENOMEM);
 	mock->domain.type = IOMMU_DOMAIN_UNMANAGED;
+	spin_lock_init(&mock->top_lock);
+	mock->amdv1.iommu.driver_ops = &mock_driver_ops;
 
 	mock->amdv1.iommu.nid = NUMA_NO_NODE;
 
-- 
2.53.0.1018.g2bb0e51243-goog

Re: [PATCH] iommufd/selftest: Add missing driver_ops for AMDV1 mock domain

[Samiullah Khawaja]

On Wed, Mar 25, 2026 at 09:46:15AM +0000, Pranjal Shrivastava wrote:
>syzbot found that allocating a mock domain with AMDV1 format could
>cause a WARN_ON because the selftest enabled DYNAMIC_TOP without
>providing the required driver_ops.
>
>Initialize a spinlock (top_lock) and dummy callbacks in the mock
>driver to satisfy the generic PT requirements.
>
>Fixes: dcd6a011a8d5 ("iommupt: Add map_pages op")
>Reported-by: syzbot+453eb7add07c3767adab@syzkaller.appspotmail.com
>Closes: https://lore.kernel.org/all/69c1d50b.a70a0220.3cae05.0001.GAE@google.com/
>Signed-off-by: Pranjal Shrivastava <praan@google.com>
>---
> drivers/iommu/iommufd/selftest.c | 23 +++++++++++++++++++++++
> 1 file changed, 23 insertions(+)
>
>diff --git a/drivers/iommu/iommufd/selftest.c b/drivers/iommu/iommufd/selftest.c
>index 9607416f8069..960c5aee4a09 100644
>--- a/drivers/iommu/iommufd/selftest.c
>+++ b/drivers/iommu/iommufd/selftest.c
>@@ -119,6 +119,7 @@ struct mock_iommu_domain {
> 		struct pt_iommu_amdv1 amdv1;
> 	};
> 	unsigned long flags;
>+	spinlock_t top_lock;
> };
> PT_IOMMU_CHECK_DOMAIN(struct mock_iommu_domain, iommu, domain);
> PT_IOMMU_CHECK_DOMAIN(struct mock_iommu_domain, amdv1.iommu, domain);
>@@ -129,6 +130,26 @@ to_mock_domain(struct iommu_domain *domain)
> 	return container_of(domain, struct mock_iommu_domain, domain);
> }
>
>+static void mock_domain_change_top(struct pt_iommu *iommu_table,
>+				   phys_addr_t top_paddr,
>+				   unsigned int top_level)
>+{
>+	/* The selftest doesn't have real hardware */
>+}
>+
>+static spinlock_t *mock_domain_get_top_lock(struct pt_iommu *iommu_table)
>+{
>+	struct mock_iommu_domain *mock =
>+		container_of(iommu_table, struct mock_iommu_domain, iommu);
>+
>+	return &mock->top_lock;
>+}
>+
>+static const struct pt_iommu_driver_ops mock_driver_ops = {
>+	.change_top = &mock_domain_change_top,
>+	.get_top_lock = &mock_domain_get_top_lock,
>+};
>+
> struct mock_iommu_domain_nested {
> 	struct iommu_domain domain;
> 	struct mock_viommu *mock_viommu;
>@@ -445,6 +466,8 @@ mock_domain_alloc_pgtable(struct device *dev,
> 	if (!mock)
> 		return ERR_PTR(-ENOMEM);
> 	mock->domain.type = IOMMU_DOMAIN_UNMANAGED;
>+	spin_lock_init(&mock->top_lock);
>+	mock->amdv1.iommu.driver_ops = &mock_driver_ops;
>
> 	mock->amdv1.iommu.nid = NUMA_NO_NODE;
>
>-- 
>2.53.0.1018.g2bb0e51243-goog
>

Reviewed-by: Samiullah Khawaja <skhawaja@google.com>

Re: [PATCH] iommufd/selftest: Add missing driver_ops for AMDV1 mock domain

[Jason Gunthorpe]

On Wed, Mar 25, 2026 at 09:46:15AM +0000, Pranjal Shrivastava wrote:
> syzbot found that allocating a mock domain with AMDV1 format could
> cause a WARN_ON because the selftest enabled DYNAMIC_TOP without
> providing the required driver_ops.
> 
> Initialize a spinlock (top_lock) and dummy callbacks in the mock
> driver to satisfy the generic PT requirements.

I'm inclined to delete the AMDv1 option entirely, I was thinking about
extending the sefltest to use it but I don't have time..

Syzkaller is hitting this because it found it can use a parameter that
the selftest never uses.

Jason

Re: [PATCH] iommufd/selftest: Add missing driver_ops for AMDV1 mock domain

[Pranjal Shrivastava]

On Thu, Mar 26, 2026 at 09:13:25AM -0300, Jason Gunthorpe wrote:
> On Wed, Mar 25, 2026 at 09:46:15AM +0000, Pranjal Shrivastava wrote:
> > syzbot found that allocating a mock domain with AMDV1 format could
> > cause a WARN_ON because the selftest enabled DYNAMIC_TOP without
> > providing the required driver_ops.
> > 
> > Initialize a spinlock (top_lock) and dummy callbacks in the mock
> > driver to satisfy the generic PT requirements.
> 
> I'm inclined to delete the AMDv1 option entirely, I was thinking about
> extending the sefltest to use it but I don't have time..
> 

Ack. so should we entirely remove MOCK_IOMMUPT_AMDV1? as in from the
uAPI header as well?

> Syzkaller is hitting this because it found it can use a parameter that
> the selftest never uses.
> 
> Jason

Thanks,
Praan

Re: [PATCH] iommufd/selftest: Add missing driver_ops for AMDV1 mock domain

[Jason Gunthorpe]

On Thu, Mar 26, 2026 at 12:25:45PM +0000, Pranjal Shrivastava wrote:
> On Thu, Mar 26, 2026 at 09:13:25AM -0300, Jason Gunthorpe wrote:
> > On Wed, Mar 25, 2026 at 09:46:15AM +0000, Pranjal Shrivastava wrote:
> > > syzbot found that allocating a mock domain with AMDV1 format could
> > > cause a WARN_ON because the selftest enabled DYNAMIC_TOP without
> > > providing the required driver_ops.
> > > 
> > > Initialize a spinlock (top_lock) and dummy callbacks in the mock
> > > driver to satisfy the generic PT requirements.
> > 
> > I'm inclined to delete the AMDv1 option entirely, I was thinking about
> > extending the sefltest to use it but I don't have time..
> > 
> 
> Ack. so should we entirely remove MOCK_IOMMUPT_AMDV1? as in from the
> uAPI header as well?

Yes

Jason