From nobody Thu Nov 5 07:29:04 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org; arc=pass (i=1 dmarc=pass fromdomain=amd.com); dmarc=pass(p=quarantine dis=none) header.from=amd.com ARC-Seal: i=2; a=rsa-sha256; t=1793406825; cv=pass; d=zohomail.com; s=zohoarc; b=PHgrm/unrM/3aHKfsK9E44BSZ1Vr3CtnG7/EN1S9MYzDi2cx5yBB6efLO0m3NDAEm/1afnG+yjOIywV2BuZrwXLfTYS7whq3S1jvYKj0f22uieu2+yWBaPpdElsckODUbi277Wc9HqbX426A1xMMW9+yy3QSSoF/BbiQExPrLwI= ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1793406825; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:List-Subscribe:List-Post:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=yih6QHYE4DaDHg0Vf0uZHGGyozrwe6Oms167g1kGBBM=; b=ZaRPFclrsgkt3XypxmA3N02aYkfCoWPic6HRT2d9vKidffZhI4PyFYtToxelKAyAr3YZ6R6BlD6YR41DHBFysdltRho22DNfzVT/UBChJaa+znOVaLhmlGKJKPD4q7JvpNn2wH/4f6HVHdL/kxzyaiENxhZiHufZf+D6MG2Spkk= ARC-Authentication-Results: i=2; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org; arc=pass (i=1 dmarc=pass fromdomain=amd.com); dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) by mx.zohomail.com with SMTPS id 1793406824773994.3950287182317; Fri, 30 Oct 2026 17:33:44 -0700 (PDT) Received: from list by lists.xenproject.org with outflank-mailman.1466498.1676458 (Exim 4.92) (envelope-from ) id 1xMx2D-0004GJ-1s; Sat, 31 Oct 2026 00:33:25 +0000 Received: by outflank-mailman (output) from mailman id 1466498.1676458; Sat, 31 Oct 2026 00:33:25 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xMx2C-0004GC-VZ; Sat, 31 Oct 2026 00:33:24 +0000 Received: by outflank-mailman (input) for mailman id 1466498; Sat, 31 Oct 2026 00:33:24 +0000 Received: from mx.expurgate.net ([195.190.135.10]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xMx2B-0004G6-Uo for xen-devel@lists.xenproject.org; Sat, 31 Oct 2026 00:33:24 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1xMx2B-00AKj3-4q for xen-devel@lists.xenproject.org; Sat, 31 Oct 2026 01:33:23 +0100 Received: from [10.42.69.4] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6ae536ea-e002-0a2a0a5209dd-0a2a4504a180-38 for ; Sat, 31 Oct 2026 01:33:22 +0100 Received: from [52.101.56.58] (helo=BN1PR04CU002.outbound.protection.outlook.com) by tlsNG-ebf023.mxtls.expurgate.net with ESMTPS (eXpurgate 4.57.1) (envelope-from ) id 6ae53751-b57f-0a2a45040019-3465383a2830-3 for ; Sat, 31 Oct 2026 01:33:22 +0100 Received: from MW4PR03CA0120.namprd03.prod.outlook.com (2603:10b6:303:b7::35) by SN7PR12MB8002.namprd12.prod.outlook.com (2603:10b6:806:34b::10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.569.10; Sat, 31 Oct 2026 00:33:13 +0000 Received: from MWH0EPF000D894F.namprd05.prod.outlook.com (2603:10b6:303:b7:cafe::63) by MW4PR03CA0120.outlook.office365.com (2603:10b6:303:b7::35) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.569.9 via Frontend Transport; Sat, 31 Oct 2026 00:33:12 +0000 Received: from satlexmb08.amd.com (165.204.84.17) by MWH0EPF000D894F.mail.protection.outlook.com (10.167.249.215) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.592.5 via Frontend Transport; Sat, 31 Oct 2026 00:33:12 +0000 Received: from satlexmb08.amd.com (10.181.42.217) by satlexmb08.amd.com (10.181.42.217) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.53; Fri, 30 Oct 2026 19:33:12 -0500 Received: from amd-BIRMANPLUS.mshome.net (10.180.168.240) by satlexmb08.amd.com (10.181.42.217) with Microsoft SMTP Server id 15.2.2562.53 via Frontend Transport; Fri, 30 Oct 2026 19:33:10 -0500 X-Outflank-Mailman: Message body and most headers restored to incoming version X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=selector1 header.d=amd.com header.i="@amd.com" header.h="From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=KhMzKwZMKQly6GmYIumdhB25xDVO/pGr8mMMMlkSforA129BbfG7MNhK7VYLsdD/KA9o0YXzMkizR+0revsXhus6vXl7LFPtFB/nqzg4cA64aByFkE1kqzOpN2f4lQNvKnVvE4NIVnyaYv4NV+PPvfN6RjgX4dYwW/bEApdKrelj1F2GnS311cQwflmTtyzc/lwxc49gK6dkq+dKQWeYnlaQtQBg5u/AOX+73m3thVmlnZVVVp7AeJGqnnylCj2gB1fWeB7wLzN1Q3HrW9KVvmhXzljeDLna3azooS8x84FPxUI37qiDJoVYYJt+Won07WiInf57arb+cEK2jvAlmg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=yih6QHYE4DaDHg0Vf0uZHGGyozrwe6Oms167g1kGBBM=; b=U/nf+ZoxSo0YhkhPIuwDOD5oBqSoMluEdhI4cQy0yihGOwGCk7vQPr3Oh2NpVYPklbmAuS3yjqSfcNRQzfhFT0SoNwY9hCQCE2xyi/s7LyKehBzyzqDVAco73HTXilMhe62TMwOlpTvPETcgQ42cwdnsrrqEUWNBVuehuVj6xHIfgrIzBFjpGfSLTZrVUl18DEHUQZ9LyUpUe7QLVCTWz+l+KjGrREeS3TTeWF9Da04rvsyFV+Yy03+1c1MUKHMCcTXFAYMMeAb0Gz/cJiaqS5y9Ya1zV8EQuCPc0tiI3E75YFFS2OyXEljoFpOvrk7tRrlNit3Rtr3nXR6ZGiKcUg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 165.204.84.17) smtp.rcpttodomain=suse.com smtp.mailfrom=amd.com; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=amd.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amd.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=yih6QHYE4DaDHg0Vf0uZHGGyozrwe6Oms167g1kGBBM=; b=Pj4NAWOfGu23NdnrtLCDLiYGgJa10xYwK8hshd3ka3eRY1H58YxmfZgXzfSGmNconrSZ4WSIhMNiDqsREQlqW1bO6cvjRH7zKXhERRowWVFcicy3efYjxdX/2KXao/AZ+W3Cb5uWR37eMSfluT38aD/A6Mvk2z/DyDDBCB3fuHQ= X-MS-Exchange-Authentication-Results: mx.microsoft.com 1; spf=pass (sender IP is 165.204.84.17) smtp.mailfrom=amd.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=amd.com; Received-SPF: pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) client-ip=192.237.175.120; envelope-from=xen-devel-bounces@lists.xenproject.org; helo=lists.xenproject.org; Received-SPF: Pass (protection.outlook.com: domain of amd.com designates 165.204.84.17 as permitted sender) receiver=protection.outlook.com; client-ip=165.204.84.17; helo=satlexmb08.amd.com; pr=C From: Jason Andryuk To: Juergen Gross , Ajay Kaher , Alexey Makhalov , "Broadcom internal kernel review list" , Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen , , "H. Peter Anvin" , Andy Lutomirski , "Peter Zijlstra" , Boris Ostrovsky , Yazen Ghannam , "Mario Limonciello" CC: Jason Andryuk , Sean Christopherson , Ingo Molnar , , , Subject: [PATCH] x86/paravirt: Add ioremap_verify_range hook and implement it for Xen PV Date: Fri, 30 Oct 2026 20:33:08 -0400 Message-ID: <20261031003309.3751-1-jason.andryuk@amd.com> X-Mailer: git-send-email 2.34.1 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: MWH0EPF000D894F:EE_|SN7PR12MB8002:EE_ X-MS-Office365-Filtering-Correlation-Id: d7fea2ce-8a16-4fb9-77d5-08df36e68c03 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|23010399003|1800799024|376014|7416014|36860700016|82310400026|921020|260925022911599003|260925021911599003|260925021311599003|11063799006|56012099006|261009223027099003|261028144727099003|261026121527099003|261026140227099003|261021121427099003|261022075727099003|261022105027099003|10067099003|18002099003|13003099007; X-Microsoft-Antispam-Message-Info: aWk6nQhKji0GcTEmX23tLPr4lYCz4W5jlrdrp2QAHXlkIK4KMFpVZFXdTeVQKmbeBFLCyrSmljHSR7EZmCUkF0HsOnnoUaocL0a+Pf5qPkayCbKfkNcyGB1DxTvws5K7IVX5eig6qTGRhdC5rCV7X9SbhmjSPpefOtXCvvPHRj61GbroMPq+HjMhTL++WH6VQC94VtKNUmhY4vCF06GCLv3BdIaKOLnn3IAAaimUWVDPD2oKYfQarklJVR9UTOOjXEzKflK2PXx5TQAoMoK319mZ2UDcV8xkmXj/u8tbHHSr9U1dY2rJYFesHi/g5Yci1rkjRc779gCqC2IwRgVKJQg3YuRfwfCNrXifytIW2dYsRFiVWGhwxGuw1hyI7U7tfSOdT5makn5MCHYmZY5sOksB7KvIeSUMh9K4eq2i7V0b1QBfqqZtFQ3AtyE9BenyJs8bpBHoMZVayU0f0LGuFmBU3bpXVwKX7ErK9ve7sdOizVc4bMCzRjlygLWAF19hHosXB7rbHWBoKvSfBtcN+0pDXw/tvQ6SXyEK2VFnzCzI+P88nAazNWeioMrem9S2E9DAZy5a9uWoUQjYuA3cmJ9ds51w9lhcI2eXz6ibzaA3Ye2P5KpninpAKtTgbCx7RjI0H1AioRp5WJny7lD6Oo11eAsfBQY9XFyJyxI1SFAypdzqAH0HZb64gGEGvkgXOjXwzJtp5HunXaBhjDvWeA== X-Forefront-Antispam-Report: CIP:165.204.84.17;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:satlexmb08.amd.com;PTR:InfoDomainNonexistent;CAT:NONE;SFS:(13230040)(23010399003)(1800799024)(376014)(7416014)(36860700016)(82310400026)(921020)(260925022911599003)(260925021911599003)(260925021311599003)(11063799006)(56012099006)(261009223027099003)(261028144727099003)(261026121527099003)(261026140227099003)(261021121427099003)(261022075727099003)(261022105027099003)(10067099003)(18002099003)(13003099007);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: NYRg0/BadDsns6DekT8ePeXb82enHV1ukRb5r52da1kdASpsWvA0mXuU15E3cFx1hHSgRYrqBbIozCDfFHTziJoruYwopYVw6igrGxSTguSTg4Qhfp++W5ZX6aGLuC0/pgqLtQ+iBtmHO5YkGhVIoBvaWaw7w6WiHvXiNrN/+EusxAjBiXA3C6/kS7w4719+P3in2EFe8BHpwuW28TAu8f+k4gXh6RyOukBly+trzlKTHOR2ngP2f8oKbLXLLahsqYlgNl5XEwtP075VkpKDdbax0Vg1ooDjbkQxlczggrJOgYBrocTr7daAbFgiQVr8/25ge/P9ko+YUJH7scHFHDj6Gc6tI+zRGXe84Bbmxq6W4db8aLcxK0XdrHeDBIAuUAUE5j526/zmVlYSPMmfbh6Hz/gqCFe5QDNVSMJIl2jAnmvcsCwd5jh47pJj89aQ X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 31 Oct 2026 00:33:12.8540 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: d7fea2ce-8a16-4fb9-77d5-08df36e68c03 X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=3dd8961f-e488-4e60-8e11-a82d994e183d;Ip=[165.204.84.17];Helo=[satlexmb08.amd.com] X-MS-Exchange-CrossTenant-AuthSource: MWH0EPF000D894F.namprd05.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN7PR12MB8002 X-purgate-ID: tlsNG-ebf023/1793406802-C32CCB50-F028D635/0/0 X-purgate-type: clean X-purgate-size: 5858 X-ZohoMail-DKIM: pass (identity @amd.com) X-ZM-MESSAGEID: 1793406825827158500 Content-Type: text/plain; charset="utf-8" Xen PV guests update page tables via hypercalls, and Xen refuses to let a domain map machine frames it does not own, such as chipset MMIO in a domU. The set_pte() paths ignore the hypercall result, so ioremap() returns a mapping whose PTEs are not present. Accessing the virtual address then faults. This was seen in print_s5_reset_status_mmio() on Xen PV domUs on AMD Zen hosts. The machine address is not accessible by the domU and faults on access. Add a pv_mmu_ops hook, ioremap_verify_range, which __ioremap_caller() calls after ioremap_page_range(). It defaults to returning success. Xen PV implements it by walking the range with lookup_address() and failing if any entry is not present, making ioremap() return NULL. This also affects a Xen PV dom0: an ioremap() of a range containing any page Xen refuses to map (e.g. MMIO Xen reserves for itself) now fails as a whole, rather than succeeding and faulting only when the refused page is accessed. Pages Xen forces read-only are still mapped present and are unaffected. Fixes: ab8131028710 ("x86/CPU/AMD: Print the reason for the last reset") Link: https://lore.kernel.org/xen-devel/20251219010131.12659-1-ariadne@aria= dne.space/ Suggested-by: Sean Christopherson Suggested-by: Borislav Petkov Signed-off-by: Jason Andryuk --- arch/x86/include/asm/paravirt.h | 10 ++++++++++ arch/x86/include/asm/paravirt_types.h | 6 ++++++ arch/x86/kernel/paravirt.c | 7 +++++++ arch/x86/mm/ioremap.c | 3 +++ arch/x86/xen/mmu_pv.c | 24 ++++++++++++++++++++++++ 5 files changed, 50 insertions(+) diff --git a/arch/x86/include/asm/paravirt.h b/arch/x86/include/asm/paravir= t.h index 0591aa38fd85..30cb1d1636e4 100644 --- a/arch/x86/include/asm/paravirt.h +++ b/arch/x86/include/asm/paravirt.h @@ -495,6 +495,11 @@ static inline void arch_leave_lazy_mmu_mode(void) arch_flush_lazy_mmu_mode(); } =20 +static inline int ioremap_verify_range(unsigned long addr, unsigned long s= ize) +{ + return PVOP_CALL2(int, pv_ops, mmu.ioremap_verify_range, addr, size); +} + static inline void __set_fixmap(unsigned /* enum fixed_addresses */ idx, phys_addr_t phys, pgprot_t flags) { @@ -557,6 +562,11 @@ static __always_inline unsigned long arch_local_irq_sa= ve(void) static inline void paravirt_enter_mmap(struct mm_struct *mm) { } + +static inline int ioremap_verify_range(unsigned long addr, unsigned long s= ize) +{ + return 0; +} #endif =20 #ifndef CONFIG_PARAVIRT diff --git a/arch/x86/include/asm/paravirt_types.h b/arch/x86/include/asm/p= aravirt_types.h index b4c4a23e77a1..674613301a83 100644 --- a/arch/x86/include/asm/paravirt_types.h +++ b/arch/x86/include/asm/paravirt_types.h @@ -164,6 +164,12 @@ struct pv_mmu_ops { =20 void (*lazy_mode_flush)(void); =20 + /* + * Verify that an ioremap()ed kernel virtual address range was + * actually mapped. Returns 0 on success. + */ + int (*ioremap_verify_range)(unsigned long addr, unsigned long size); + /* dom0 ops */ =20 /* Sometimes the physical address is a pfn, and sometimes its diff --git a/arch/x86/kernel/paravirt.c b/arch/x86/kernel/paravirt.c index 00b59d774389..b1bc519c660d 100644 --- a/arch/x86/kernel/paravirt.c +++ b/arch/x86/kernel/paravirt.c @@ -88,6 +88,11 @@ static noinstr void pv_native_set_debugreg(int regno, un= signed long val) { native_set_debugreg(regno, val); } + +static int native_ioremap_verify_range(unsigned long addr, unsigned long s= ize) +{ + return 0; +} #endif =20 struct pv_info pv_info =3D { @@ -207,6 +212,8 @@ struct paravirt_patch_template pv_ops =3D { =20 .mmu.lazy_mode_flush =3D paravirt_nop, =20 + .mmu.ioremap_verify_range =3D native_ioremap_verify_range, + .mmu.set_fixmap =3D native_set_fixmap, #endif /* CONFIG_PARAVIRT_XXL */ }; diff --git a/arch/x86/mm/ioremap.c b/arch/x86/mm/ioremap.c index 12c8180ca1ba..6b45a7eef593 100644 --- a/arch/x86/mm/ioremap.c +++ b/arch/x86/mm/ioremap.c @@ -301,6 +301,9 @@ __ioremap_caller(resource_size_t phys_addr, unsigned lo= ng size, if (ioremap_page_range(vaddr, vaddr + size, phys_addr, prot)) goto err_free_area; =20 + if (ioremap_verify_range(vaddr, size)) + goto err_free_area; + ret_addr =3D (void __iomem *) (vaddr + offset); mmiotrace_ioremap(unaligned_phys_addr, unaligned_size, ret_addr); =20 diff --git a/arch/x86/xen/mmu_pv.c b/arch/x86/xen/mmu_pv.c index 377c3c0d9f20..e524d318171f 100644 --- a/arch/x86/xen/mmu_pv.c +++ b/arch/x86/xen/mmu_pv.c @@ -359,6 +359,29 @@ static void xen_set_pte(pte_t *ptep, pte_t pteval) __xen_set_pte(ptep, pteval); } =20 +/* + * PTE updates are made via (possibly batched) hypercalls whose failures + * are not propagated back to the caller. Xen refuses to let a domain map + * machine frames it does not own (e.g. chipset MMIO in a domU), leaving t= he + * PTE not present. Walk the range to make sure every page got mapped. + */ +static int xen_ioremap_verify_range(unsigned long addr, unsigned long size) +{ + unsigned long end =3D addr + size; + unsigned int level; + pte_t *pte; + + while (addr < end) { + pte =3D lookup_address(addr, &level); + if (!pte || !pte_present(*pte)) + return -ENXIO; + + addr =3D (addr & page_level_mask(level)) + page_level_size(level); + } + + return 0; +} + static pte_t xen_ptep_modify_prot_start(struct vm_area_struct *vma, unsigned long addr, pte_t *ptep) { @@ -2218,6 +2241,7 @@ void __init xen_init_mmu_ops(void) pv_ops.mmu.enter_mmap =3D xen_enter_mmap; pv_ops.mmu.exit_mmap =3D xen_exit_mmap; pv_ops.mmu.lazy_mode_flush =3D xen_flush_lazy_mmu; + pv_ops.mmu.ioremap_verify_range =3D xen_ioremap_verify_range; pv_ops.mmu.set_fixmap =3D xen_set_fixmap; =20 memset(dummy_mapping, 0xff, PAGE_SIZE); --=20 2.34.1