From nobody Sat Jul 25 18:53:13 2026 Received: from CY7PR03CU001.outbound.protection.outlook.com (mail-westcentralusazon11010019.outbound.protection.outlook.com [40.93.198.19]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2B2C4427F9B; Tue, 14 Jul 2026 20:55:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=40.93.198.19 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784062548; cv=fail; b=BvEcrUsYiWTgzfbWJxSxbvENPjLP/z9YnhZDMqXVavBAfQ814q80l7K7IpERc8o/oFRpgavmIuQMOiXmZhvTkIiXeGL+leheRwIXt9QuYhh3RjknBDtaJ8AuYY4vtLW3FKHpevVjZhREdEzTE3TGQZ/pqClBT4B+mcJhUnyw8QI= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784062548; c=relaxed/simple; bh=bHgtICmBUE4BIMSmGPahfKS4LI+QYxwc+FfYogE0LCI=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=mEmzWXQIEjBAOqy6Jh4dSS3DXp37DLWPRJFBtnC6l4SVy/KFL2EDGGu22wALbcnq3a8u+qN5OJpitftRRTodRvEr++VdEHuxnQTXB3U3XUfyKhmVkpaLtxeeec4x9KtJkffsfXA2gzAfM7bEVapsccfgJUe//x4lENQBjbWal2c= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=oFj3IyLL; arc=fail smtp.client-ip=40.93.198.19 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="oFj3IyLL" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=adeCSR9mIwKdeejRzMF0YepAIM5BS8IlRd2Sz6WkSYRDw3Bovn/zTN2EEF/5UT29NCXJSuycLjv9T+K7iYxkoDApfo688QdoRaUXuC/nYXqCU0A82Uc3VeP8TpqXOhZfvoupyS+6JK0Wqx3Z+RNbVAedLvQJeSjzcTmN/B8IFFTAFvGvzSPpLro4DfLb6h62Xz4cSVDeqyfrWm39NWjtuQTzpP5b5qG6Pk5BjBweBMkY86D/H3yL6GJ52fAgwG45yTSLwX9Yia4t09LtXm/1qoMVN2BqE1JomCmOrqwH+avyZpX/WldWNGj/30iNq93H3EPRPsPWhcaIiM21jdXVqw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=MA+7HpBscRRKuEVDeL83ihJ4j9C5ymr5oo+IEq87FX8=; b=r++cTK2MlMXP3wY2sXCiSlnrTtTUEV8gLCJ7hwe6XUoTJzGpxgFvGlD9zgh/3xPJF153M95P6jx158DfTzTd8pKqFqzFkMPymE18kgBV05TCK7ypvMysV9lBJGWtYiqpoje1cvdFmZcr/pwNK86ka/xqARnI9+JClnHl9rkcy3Qt7s+46HQF5u2msRzAanQlWSdw8AcQHX1tOrpLW0hCRys+sZvuGO4H+HrTBQemMrb5oi9XQyQ6BlPl5F8HYgqqru5jyatNi5/CN/SH6Tze31lumVULk6CLHJsDI4sywmgxQN1tp1yBgBo4Ljp2JHXJYEdimHiojdr7PrAEmR8uWQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.118.232) smtp.rcpttodomain=kernel.org smtp.mailfrom=nvidia.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=MA+7HpBscRRKuEVDeL83ihJ4j9C5ymr5oo+IEq87FX8=; b=oFj3IyLL7h2p8mwJivcCh4m88gRG7QcB4mea+Q9CVp6jo4MFPeB7feCJa+lZWSJLYwnOZtZuX/p8+UisXqE1KslDAiAFE1VdKi9odctfLN9kR8XO+hitgGOtRv9ggJfU/ywgQ3PGBxmX4DvmWt0tT09EHvE9E11P8Zg28OCglep7f2Blgf8Bh5kXQ0+5Jh2W3V/KwZF30pSHH9Y2hR3k+4WWQX9xMZ8xYpP5SfHIJENhiZIF7sUTcQVhBnBSKz7gyuehRCDnhpfVgpbR2e+etWYskyafPOuace/OfFLrO8VpoXx3Z1FjmjcAG+8EjHiK/0x/2b+5OeSF0nHWCbC11Q== Received: from PH8PR22CA0004.namprd22.prod.outlook.com (2603:10b6:510:2d1::19) by CH3PR12MB8185.namprd12.prod.outlook.com (2603:10b6:610:123::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.223.9; Tue, 14 Jul 2026 20:55:29 +0000 Received: from CY4PEPF0000FCC4.namprd03.prod.outlook.com (2603:10b6:510:2d1:cafe::91) by PH8PR22CA0004.outlook.office365.com (2603:10b6:510:2d1::19) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.223.10 via Frontend Transport; Tue, 14 Jul 2026 20:55:28 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.118.232) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.118.232 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.118.232; helo=mail.nvidia.com; pr=C Received: from mail.nvidia.com (216.228.118.232) by CY4PEPF0000FCC4.mail.protection.outlook.com (10.167.242.106) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.223.9 via Frontend Transport; Tue, 14 Jul 2026 20:55:28 +0000 Received: from drhqmail202.nvidia.com (10.126.190.181) by mail.nvidia.com (10.127.129.5) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.43; Tue, 14 Jul 2026 13:55:12 -0700 Received: from drhqmail201.nvidia.com (10.126.190.180) by drhqmail202.nvidia.com (10.126.190.181) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20; Tue, 14 Jul 2026 13:55:11 -0700 Received: from Asurada-Nvidia.nvidia.com (10.127.8.11) by mail.nvidia.com (10.126.190.180) with Microsoft SMTP Server id 15.2.2562.20 via Frontend Transport; Tue, 14 Jul 2026 13:55:11 -0700 From: Nicolin Chen To: Will Deacon CC: Robin Murphy , "Joerg Roedel (AMD)" , Jason Gunthorpe , , , , Subject: [PATCH v2 01/11] iommu/tegra241-cmdqv: Publish an LVCMDQ only after it is fully initialized Date: Tue, 14 Jul 2026 13:54:58 -0700 Message-ID: <3e0d9156cd7ade5a5ee0b9a63a326dc324866ddf.1784059577.git.nicolinc@nvidia.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-NV-OnPremToCloud: ExternallySecured X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CY4PEPF0000FCC4:EE_|CH3PR12MB8185:EE_ X-MS-Office365-Filtering-Correlation-Id: e7d9905a-148c-46da-6c7e-08dee1ea3c44 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|82310400026|36860700016|23010399003|1800799024|376014|18002099003|22082099003|11063799006|56012099006; X-Microsoft-Antispam-Message-Info: pQgy24PFosIG1ojQb0yip7aNWxYVxSZnvq5rivkLcztuYJOQFY+x+PedSF9lqNKUvJnoyy1QpeSb6+2CoLJM5s8RNFlz0IBr+qjBdWmJKCTceJTeYnet1/NEjaY6VXlvyJ9+iY/XdFlHKyZdEnhPK6eMqQ8ApbbK+MqBMpaYdtsYYRJlIuglt4D7YsrUc/43EHGpQDigZStjR2v/Ev+9nsm8nZPNPuSWmAAbGu6TxhntBT+jWNocibgg8Kq/o11EHUVy09BBWcjCwJ28M5GllDVkXRv5Iy2eqaOHH4kp42yGJBW//zAPKZ/GSJjWAHMLKBbdjWwLI6bZpm1NNY4i2uelggGiB+dz5sbPiQzjbFXN/Jh4MRrrfl0wVLvpik0lYW8VVRp4UmkGeKajVtiWcN6KT023zenr4fRUn78XOKc2TxVNqUqxotN8eeqrLOg0gu9J1LKKK20qh3LkqM72w/DQB9xAECbq6MBuIT0VvTUfg+k/ZPsR3G8lP+CYP3ThL1SCdS9vYk8UTWbVQ5hfWLMI+zimw6dXQJ5bLrCw/cfGROVWJ4TvoyFLxQUBOShQbM6jKMlQ8UlY5Ms9xci8FlGdwJn/lCMUtWYwEhgARFqrHbcUjUgM7/sLx0ICx+olIMVZJp3Od+bXVYtrXr9mQkVI9L3dPYR5Gz/4mos1tgRXhsnCAzymVnz4Vr4WEGxfxr/vElIOswAP/qZVmkSPCQ== X-Forefront-Antispam-Report: CIP:216.228.118.232;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:dc7edge1.nvidia.com;CAT:NONE;SFS:(13230040)(82310400026)(36860700016)(23010399003)(1800799024)(376014)(18002099003)(22082099003)(11063799006)(56012099006);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: gtyiXWAUe8C5z0YdQ1t/ZYPY0qfDU4WhK5B65lJMCgatwRWqkaTDZSnQS9zA/r2fGZbfCkG73QCpeCoCWT2DPXwjQQ7vidmuw5MLJ+t1OekV0mPQ+moza6BZbXAEulu9Isqv0wvFCzNVlbmXkP3kEjn93ddnRRBdmtB2QcZehexKImBwi+x/0BTQ4HcdOxmt6upa9OFOkJBINM4r144RPjPBIpjYfaYztuafg6IXxY1eq5Ht7k6njO8QdhKIhe8RwyeA7kDjfAcpYzHpXg7axTVFnQgFnvxX94P3riOWPMHx+ditJJqKbWYH2AfgQrxURG8X40/Wldwf7sQ9rlVPnO3v2ms/hnB5vdww3HUy6F0fYu1sRUlly8AmrSgSsvgddXlrI5m3Q6e1XE/aElFeyDnIGrB1/eL9QKzaHk9Sqws+xJ/OI1yQk4adHDAZrjag X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 14 Jul 2026 20:55:28.1709 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: e7d9905a-148c-46da-6c7e-08dee1ea3c44 X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.118.232];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: CY4PEPF0000FCC4.namprd03.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH3PR12MB8185 Content-Type: text/plain; charset="utf-8" tegra241_vintf_init_lvcmdq() stores the freshly allocated vcmdq pointer to the vintf->lvcmdqs[] array, before tegra241_vcmdq_alloc_smmu_cmdq() builds the vcmdq->cmdq. The error ISR dereferences that cmdq, so a latched LVCMDQ error (e.g. one inherited across a kexec) firing in this window would make tegra241_vintf0_handle_error() pass the still-zeroed arm_smmu_cmdq down to __arm_smmu_cmdq_skip_err(), dereferencing NULL queue register pointers. Drop the store from tegra241_vintf_init_lvcmdq() and publish the vcmdq at the end of the allocation instead, with an smp_store_release() that pairs with an smp_load_acquire() in the ISR, which can see a fully built LVCMDQ or NULL. The user-owned LVCMDQ allocation moves accordingly, publishing the vcmdq once tegra241_vcmdq_hw_init_user() succeeds, using a plain store since a user VINTF's lvcmdqs[] has no lockless reader -- the error ISR only walks the VINTF0 array. Fixes: 918eb5c856f6 ("iommu/arm-smmu-v3: Add in-kernel support for NVIDIA T= egra241 (Grace) CMDQV") Assisted-by: Claude:claude-fable-5 Signed-off-by: Nicolin Chen --- .../iommu/arm/arm-smmu-v3/tegra241-cmdqv.c | 25 +++++++++++++------ 1 file changed, 17 insertions(+), 8 deletions(-) diff --git a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c b/drivers/iommu= /arm/arm-smmu-v3/tegra241-cmdqv.c index 67be62a6e7640..f843d607c8134 100644 --- a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c +++ b/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c @@ -318,12 +318,19 @@ static void tegra241_vintf0_handle_error(struct tegra= 241_vintf *vintf) =20 while (map) { unsigned long lidx =3D __ffs64(map); - struct tegra241_vcmdq *vcmdq =3D vintf->lvcmdqs[lidx]; - u32 gerror =3D readl_relaxed(REG_VCMDQ_PAGE0(vcmdq, GERROR)); + struct tegra241_vcmdq *vcmdq; + u32 gerror; =20 + map &=3D ~BIT_ULL(lidx); + + /* Pairs with smp_store_release() publishing it */ + vcmdq =3D smp_load_acquire(&vintf->lvcmdqs[lidx]); + if (!vcmdq) + continue; + + gerror =3D readl_relaxed(REG_VCMDQ_PAGE0(vcmdq, GERROR)); __arm_smmu_cmdq_skip_err(&vintf->cmdqv->smmu, &vcmdq->cmdq); writel(gerror, REG_VCMDQ_PAGE0(vcmdq, GERRORN)); - map &=3D ~BIT_ULL(lidx); } } } @@ -666,7 +673,6 @@ static int tegra241_vintf_init_lvcmdq(struct tegra241_v= intf *vintf, u16 lidx, vcmdq->page0 =3D cmdqv->base + TEGRA241_VINTFi_LVCMDQ_PAGE0(idx, lidx); vcmdq->page1 =3D cmdqv->base + TEGRA241_VINTFi_LVCMDQ_PAGE1(idx, lidx); =20 - vintf->lvcmdqs[lidx] =3D vcmdq; return 0; } =20 @@ -705,14 +711,15 @@ tegra241_vintf_alloc_lvcmdq(struct tegra241_vintf *vi= ntf, u16 lidx) /* Build an arm_smmu_cmdq for each LVCMDQ */ ret =3D tegra241_vcmdq_alloc_smmu_cmdq(vcmdq); if (ret) - goto deinit_lvcmdq; + goto free_vcmdq; + + /* Pairs with the smp_load_acquire() in the error ISR */ + smp_store_release(&vintf->lvcmdqs[lidx], vcmdq); =20 dev_dbg(cmdqv->dev, "%sallocated\n", lvcmdq_error_header(vcmdq, header, 64)); return vcmdq; =20 -deinit_lvcmdq: - tegra241_vintf_deinit_lvcmdq(vintf, lidx); free_vcmdq: kfree(vcmdq); return ERR_PTR(ret); @@ -1130,13 +1137,15 @@ static int tegra241_vintf_alloc_lvcmdq_user(struct = iommufd_hw_queue *hw_queue, if (ret) goto unmap_lvcmdq; =20 + /* No lockless reader of a user VINTF's lvcmdqs[]; mutex-serialized */ + vintf->lvcmdqs[lidx] =3D vcmdq; + hw_queue->destroy =3D &tegra241_vintf_destroy_lvcmdq_user; mutex_unlock(&vintf->lvcmdq_mutex); return 0; =20 unmap_lvcmdq: tegra241_vcmdq_unmap_lvcmdq(vcmdq); - tegra241_vintf_deinit_lvcmdq(vintf, lidx); undepend_vcmdq: if (vcmdq->prev) iommufd_hw_queue_undepend(vcmdq, vcmdq->prev, core); --=20 2.43.0 From nobody Sat Jul 25 18:53:13 2026 Received: from BN1PR04CU002.outbound.protection.outlook.com (mail-eastus2azon11010013.outbound.protection.outlook.com [52.101.56.13]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 77926429CCC; Tue, 14 Jul 2026 20:55:42 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=52.101.56.13 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784062548; cv=fail; b=SUGQmLw29BAoBlcqLwcAoxI5W1HGA/MpYVozjVlRFtRgm3T5DH8XiatMw5JeZELrliWPtbE0mzEfUsjKdgKDruEPBzDIBSyRQ5/Q3z/lEfB9Ygm2e5IkQG/+6O0ushBkrEZ1sEMtafOUYU2LQFy7hpwQKtmZ6tSCCh16GmHzmmE= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784062548; c=relaxed/simple; bh=dJkSFZuPyOCn2YqRnFknznUCjwRCLWqsZgJIXAcfyew=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=lQf1kvgbGlBNyb1bfwgGA9mV71kv6c1DIUqkQtuXa6gBq93AiOYufRioLdM+bjLtbvwMFgCw7c5UjdMIj6l34jFjRkaGj5AweE7CRabk8Mcv2JEdjw3nCdWnYr0acIpuOkH1CJ11QypuQzJ5EUvj3H1FrZLbqcz1ipzUuBo67g0= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=WaWe9CCJ; arc=fail smtp.client-ip=52.101.56.13 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="WaWe9CCJ" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=BFGnTqOPQC3VolKBwdcJ7NU4LDvu8yE9RlD8SEwU3qa5Bf8zjQY2foBYhjkBqA/XpJ60JE42W1CCOfOig6md+LkbWPDgo0Kup1SDPZlcc7qt63tP698Xhy7U7HNgbQWLQKtqLMC4PcZD3MWiVoZqbmdW9yjssiwsaRADhWbw/Paf0RjXnHV+fhs4gdmBT2wXRGTsuZTu+ISWuVwvwaMGJvLpSM0we+VbcU7zwTHfF4P4J3pypkHarizDQEdly1Gq69+a/X/6Wx9wcwpd6jmVbLbbJSrBqImEleq58AhFxp7E0nV5KjK61djtNr86JdWd2U6LzITKtPamv4/UtLR+LQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=T9gAHke43E9NARCgwLis/EWSuaL8oNtcCDvUCs3PF3E=; b=Wh0PEy2E0Jp+Egsuigak6Tm8ibgtInGKHWiQCwp+vW6erCC36s/BFh8Su5f7z4EH4jrtwaDYxgUH95nKO+06EoSG5dBIkUX0m6P0VT9XCBF8kcATDvi96mAip69WBMlp7SR5lryzLV+gNaSDia0itAe71c7G7CGIDy3+Snhe+LVe30LhHnBavVOyPqDA7XjHslEabUrR7Fda3v08QEVWgtAEQhtLAjLAuHUmqQto3AvRkmdO0k7A0lHXhtC1k5KGMOKejRwK8/Z2JtvGmoqCdYCcJOhtHbzWiDED3A4+hJGOgGk+R5Rii12mlVM/pKSdaGLDUXr6AtUtC9ndgyngYw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.118.233) smtp.rcpttodomain=kernel.org smtp.mailfrom=nvidia.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=T9gAHke43E9NARCgwLis/EWSuaL8oNtcCDvUCs3PF3E=; b=WaWe9CCJxSk2jw46RXQRQxSXvRhtamH5nyHN6UVc1tQyPhEkjCLrCGFu+XgWXk56iWSpb6UqQ3R9MmDrafCv6Ilnq23Gp/osFwRMwY8gHMvLB9VuE7JtLMCf3DjnwIgXu5rryocwcrikDBNeKKuliYHM/mf5WzJtbfJAh54PnJD/IBAAFuF/p69Dw5sbqSfSihSS7Hn32X85CRSVM2PsqBe9VKkJItTHTmTNF6wMS+GBbvmfhW4fkyoS6mqseoDFctxFif2Z+AKRmxBHE8FPbQP+c8ABkTaOKWuWHfw2lmscmFjP8XbiWPyCKhBGEPYVkNYhjZgcYfN76njBhg+K2w== Received: from BN9PR03CA0589.namprd03.prod.outlook.com (2603:10b6:408:10d::24) by DS7PR12MB5741.namprd12.prod.outlook.com (2603:10b6:8:70::7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.223.9; Tue, 14 Jul 2026 20:55:33 +0000 Received: from BL02EPF0001A0FD.namprd03.prod.outlook.com (2603:10b6:408:10d:cafe::5d) by BN9PR03CA0589.outlook.office365.com (2603:10b6:408:10d::24) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.202.19 via Frontend Transport; Tue, 14 Jul 2026 20:55:33 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.118.233) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.118.233 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.118.233; helo=mail.nvidia.com; pr=C Received: from mail.nvidia.com (216.228.118.233) by BL02EPF0001A0FD.mail.protection.outlook.com (10.167.242.104) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.223.9 via Frontend Transport; Tue, 14 Jul 2026 20:55:32 +0000 Received: from drhqmail202.nvidia.com (10.126.190.181) by mail.nvidia.com (10.127.129.6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20; Tue, 14 Jul 2026 13:55:13 -0700 Received: from drhqmail201.nvidia.com (10.126.190.180) by drhqmail202.nvidia.com (10.126.190.181) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20; Tue, 14 Jul 2026 13:55:12 -0700 Received: from Asurada-Nvidia.nvidia.com (10.127.8.11) by mail.nvidia.com (10.126.190.180) with Microsoft SMTP Server id 15.2.2562.20 via Frontend Transport; Tue, 14 Jul 2026 13:55:12 -0700 From: Nicolin Chen To: Will Deacon CC: Robin Murphy , "Joerg Roedel (AMD)" , Jason Gunthorpe , , , , Subject: [PATCH v2 02/11] iommu/tegra241-cmdqv: Synchronize the error ISR against VINTF (de)init Date: Tue, 14 Jul 2026 13:54:59 -0700 Message-ID: <0ed2144a80a3750ee6638336b575b5b968949be6.1784059577.git.nicolinc@nvidia.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-NV-OnPremToCloud: ExternallySecured X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: BL02EPF0001A0FD:EE_|DS7PR12MB5741:EE_ X-MS-Office365-Filtering-Correlation-Id: 71da4e7e-eda0-4f63-fc8d-08dee1ea3f12 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|82310400026|36860700016|23010399003|1800799024|376014|18002099003|22082099003|5023799004|56012099006|11063799006|6133799003; X-Microsoft-Antispam-Message-Info: d7eT6Gec08Y1/esLsCukZ0bcihCbtDNB89jiptz+t4Q/pTI7WeNjAxMs+g4XF64jTR82mtNt6oAtn8Vtvaxtp0k5jzqNJ1VjivUyoO0e/Ai28KrKNE2WbgE7rE/7/JRMtWr1CV7O4qU/55pNR7sraoKhA3jj7fFu17P0s40EERaJN6XzERt3d86fkYxi5XzU6H0NCJ9EjwVFzS33qAdYvieXJHJsZSWKvNXFX3Mpt6toVPImbBwLYaXkyBhk83w39Z3Dd5DB1bRpRT3l9cZNvxu3i8xvqvSuScReMlg+5w14yFdSvMnmo6MoL3dYV5jYv3+ghIas0oItKg8Eo74f0IyaJXUp+/rHAMIJVXDYN4Ce5BGCFz3gtSsrfGM2oPmKvfVl/qzbGUYocUxdoGmIlNfUdRCjuNBkoGIA5ZtTRZYds984vxlMU152pgTEATDiZZAAdN4t1HjsoA34MET9+3hklsYDY22OBbY5RM8zTce+Hvc493dCi4umWsVxrSPC37NU/sbg8zo0krm1uUeTZf+B7w6z8yUl/tIM6m4v+RusMSAnDY/ChNoYYJyY5p4XZggH+QX0g/xHgd02f3Td3lIiyXDSFDZpMkIdRlGlZpsiUpNp0ylO+QlQ3retCc6Vxvh/BG7nlAah9Cw4vO5wVeSR9JhEWWiCJMOQiWXpYkOTVvPjTXn15iElI6q4NXYDO50J/q9qs2bzOW+ZUNsPqQ== X-Forefront-Antispam-Report: CIP:216.228.118.233;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:dc7edge2.nvidia.com;CAT:NONE;SFS:(13230040)(82310400026)(36860700016)(23010399003)(1800799024)(376014)(18002099003)(22082099003)(5023799004)(56012099006)(11063799006)(6133799003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: /FGbpdsdUWML/TixHq2XQP0RB14DBPCgwANeRqYSUMNe0pJEduPpWkkRLUvmtK4eodmZ3Jh4zjVxh/cKoDQORi1JOgLnxCWxLMAHHVF7EfzhJ/NJDvsR0SioCe7tu3epcj6WMfopfY1UOhekN22vEiF2ft47CU6nvpFvzYmhcvPN3QB8mgCvRY3NnKhhH6h04+EVTxniNv1kLzkARSDD4BaFrs0iI8QGXFbI8RSDH2RVqHk+0f5fkBzWxshD50DZWxQNlBeeFdMnhIINUFN/pOSkiApJKeH8QI3Jb8r+7ZTU/SbKmolDL1VL9Ab0L7uD6aSFN/SfSCHid9FMgFx9j2ELOYsXfagjSrVdqkE9ngjVAw7ABrS6DOMG9tptYpbtU3mpDQ55l8SXnVdbv0a6jhzrrRBPlni5rC8fQha63x2Q8eq5tJ743BqA3fWcIEN9 X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 14 Jul 2026 20:55:32.7892 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 71da4e7e-eda0-4f63-fc8d-08dee1ea3f12 X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.118.233];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: BL02EPF0001A0FD.namprd03.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: DS7PR12MB5741 Content-Type: text/plain; charset="utf-8" A user VINTF is torn down by tegra241_cmdqv_deinit_vintf(), which runs from the destroy callback and from the init-failure unwind in the alloc handler. It clears the cmdqv->vintfs[] slot and lets the iommufd core free it, but nothing serializes that against the error interrupt: tegra241_cmdqv_isr() reads cmdqv->vintfs[idx] and dereferences the vintf. A concurrent error can make the ISR read a slot mid-clear (a NULL deref) or use a vintf which is about to be freed (a use-after-free). deinit_vintf() also returns idx to the IDA before clearing the slot, so a concurrent create that reuses idx can publish its new vintf into the slot, only for this teardown to erase it again with the stale NULL store. On the other end, tegra241_cmdqv_init_vintf() publishes a new vintf with a plain store to the cmdqv->vintfs[] slot, and the ISR dereferences fields of a published vintf such as vintf->base. A plain store gives no ordering on a weakly-ordered CPU, and a stale VINTF_ERR_MAP bit on a reused idx can make the ISR pick a vintf the moment it is published, before its fields are set or tegra241_vintf_hw_init() runs. The cmdqv->vintfs[0] slot stays NULL until tegra241_cmdqv_init_structures() first creates VINTF0, so the slot 0 read needs the same NULL check. Publish every slot with an smp_store_release(), and read each slot in the ISR with an smp_load_acquire() under a NULL check, so the ISR always sees a fully built vintf or NULL. Also make deinit_vintf() clear the slot, and synchronize_irq() prior to returning idx to the IDA, so no vintf is freed under a running handler and no reused idx is clobbered. Fixes: 4dc0d12474f9 ("iommu/tegra241-cmdqv: Add user-space use support") Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Nicolin Chen --- .../iommu/arm/arm-smmu-v3/tegra241-cmdqv.c | 37 +++++++++++++++++-- 1 file changed, 33 insertions(+), 4 deletions(-) diff --git a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c b/drivers/iommu= /arm/arm-smmu-v3/tegra241-cmdqv.c index f843d607c8134..5fbc1c85874a5 100644 --- a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c +++ b/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c @@ -335,6 +335,13 @@ static void tegra241_vintf0_handle_error(struct tegra2= 41_vintf *vintf) } } =20 +/* + * The CMDQV error interrupt is edge-triggered, so a pending VINTF error f= ires + * this ISR once and does not re-assert. An unacked guest therefore cannot + * storm the host. The HW latches and forwards each new error event on its + * own, so an already-set ERR_MAP bit does not suppress the interrupt for a + * new error. + */ static irqreturn_t tegra241_cmdqv_isr(int irq, void *devid) { struct tegra241_cmdqv *cmdqv =3D (struct tegra241_cmdqv *)devid; @@ -357,16 +364,27 @@ static irqreturn_t tegra241_cmdqv_isr(int irq, void *= devid) =20 /* Handle VINTF0 and its LVCMDQs */ if (vintf_map & BIT_ULL(0)) { - tegra241_vintf0_handle_error(cmdqv->vintfs[0]); + struct tegra241_vintf *vintf0; + vintf_map &=3D ~BIT_ULL(0); + + /* NULL until tegra241_cmdqv_init_structures() publishes it */ + vintf0 =3D smp_load_acquire(&cmdqv->vintfs[0]); + if (vintf0) + tegra241_vintf0_handle_error(vintf0); } =20 /* Handle other user VINTFs and their LVCMDQs */ while (vintf_map) { unsigned long idx =3D __ffs64(vintf_map); + struct tegra241_vintf *vintf; =20 - tegra241_vintf_user_handle_error(cmdqv->vintfs[idx]); vintf_map &=3D ~BIT_ULL(idx); + + /* The slot may be published or torn down (NULL'd) concurrently */ + vintf =3D smp_load_acquire(&cmdqv->vintfs[idx]); + if (vintf) + tegra241_vintf_user_handle_error(vintf); } =20 return IRQ_HANDLED; @@ -730,8 +748,18 @@ tegra241_vintf_alloc_lvcmdq(struct tegra241_vintf *vin= tf, u16 lidx) static void tegra241_cmdqv_deinit_vintf(struct tegra241_cmdqv *cmdqv, u16 = idx) { kfree(cmdqv->vintfs[idx]->lvcmdqs); + /* + * Clear the slot and drain any in-flight ISR before returning idx to + * the IDA, so a concurrent create that reuses idx cannot have its + * freshly published VINTF erased here. A plain WRITE_ONCE() suffices + * since clearing the slot publishes no data. This also covers the + * init-failure unwind, which reaches deinit_vintf() without the + * destroy callback. + */ + WRITE_ONCE(cmdqv->vintfs[idx], NULL); + if (cmdqv->irq > 0) + synchronize_irq(cmdqv->irq); ida_free(&cmdqv->vintf_ids, idx); - cmdqv->vintfs[idx] =3D NULL; } =20 static int tegra241_cmdqv_init_vintf(struct tegra241_cmdqv *cmdqv, u16 max= _idx, @@ -757,7 +785,8 @@ static int tegra241_cmdqv_init_vintf(struct tegra241_cm= dqv *cmdqv, u16 max_idx, return -ENOMEM; } =20 - cmdqv->vintfs[idx] =3D vintf; + /* Pairs with the smp_load_acquire() in tegra241_cmdqv_isr() */ + smp_store_release(&cmdqv->vintfs[idx], vintf); return ret; } =20 --=20 2.43.0 From nobody Sat Jul 25 18:53:13 2026 Received: from SN4PR0501CU005.outbound.protection.outlook.com (mail-southcentralusazon11011056.outbound.protection.outlook.com [40.93.194.56]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6D35B423E9F; Tue, 14 Jul 2026 20:55:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=40.93.194.56 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784062539; cv=fail; b=lMQSi6q1/FvhVyNlaCD/fhaadPM4dbNIp8dj3Wb9Cj+pozbs3GC7aREDAUh4FVLC+HU1wgO60WGz0NyHJI0pbX7ZUGCwgjcfhKf5ivIZH9VgaGtAf1XbsIHFREesujvcnb2vlagveFo1z1zwtt+3P9b5R8X3g5BETRiK6nB4PAs= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784062539; c=relaxed/simple; bh=hF9xfq0+xl+JGP+/zr8yaGJRhG6x1lW9LN48P/e8x04=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=IvrNTFhKPUV+JmA3tnJJChBUzZKaFzQFOq3rWDO+ySEctyGkHz79KX75oREjD/vxjySryS0yprOInH+N5QcNN92UPqsDJ1rbYSHWof9549Oln/P8eIG9f3Oyfr7KezWzDQNnqM8l9oPZx/ikQPiQG+Yd2pWxwF1i1kWXGybiGqg= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=FzYA80Yb; arc=fail smtp.client-ip=40.93.194.56 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="FzYA80Yb" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=cBIu3hcEBRlXUFN7xarBajy7V0NS84pi29wadhL2Qb65Z0p7tdwU93I/Bn9V6uM/RgQFYNqZc81nK41b2qP72J4Dl85frx1kx4z9gim27OVPRLyfEraDHT0ECVTfOmlSNCDPM2iLHcmz2knfa705UzZZrdjXy80J7+VaVOp9S0FjLluKEQZPHPLDzlWXbUXKktYfPch6+vXqUmbx/BgmOSi1JdBWVZRmARFs1Cs1jjc9Wujh74YWAU60LzBHRKHI8/4dU0TYOSdHrxNLZFuuHH/Z1MztMjMA56AqyinKxVmrq7zHVxyFbybH2f3CqaCai5U2OJqtBwb/+VvnfM2DJA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=5+qyzeH3wgqhS4tfQFs30KyMUJfu37dqvW6aa7eWpvU=; b=h8bT3gxxd50yhPdFNA86sKxyZ3ITKdbXA/UAampUkwyn5l3nGLg9Zh7Fb34pfuYDgwP45ICjaRcy+sLSIRimZMWqmQWGFVBZLL7lD7saS2WJ+1cVCQub+t34TGyRdV+oti5+NQ9VFnZGtF7V2I/gPbqKDYyQbLCEEopbAB1vydpXQOiN8nRYA+8WYk96Wg9NRj4P75c+EHmK+rodSckckPOzrjIDOycF+bN7Rw8pDxaTMadQRGHx5H838DXE8WbG6bjSh1GcteVoC3RWVinJ9Y6O9UZSY4n6k9cv7w7dVd91qicpGFj7wB5sWxRIIjC56gtEvbEnEnd6IGN62KIAJw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.118.233) smtp.rcpttodomain=kernel.org smtp.mailfrom=nvidia.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=5+qyzeH3wgqhS4tfQFs30KyMUJfu37dqvW6aa7eWpvU=; b=FzYA80Yb/WDGOyyzM9AOeZXg/5F2kHdN4XABx/dwU594CzvOv6+kXiiiC1q5/xTupq6JYXrg4DwfWVuAsssBVDc3guCvnW+F0wrHZ/STPRV+iPrWTCFT8AXrioY5GTKi/0NIadaTaq35QESVyz2ZrKYOw0TV7137FRL16wyZjdznaTqB5SJCnXP9yutXCMCM5IhcwWan2LN4RAO0JHOhjUdZsBjfTJKct2GkKxColxVaDeo+qJHFoIdrwkUvaJLHvqb7n1JHfuPexEURtwXzg0wqh1Xa6UHlE5PwrCk7ebatC04o+TZ1nXaf/o2VGnY0IyOqXiSLEph8FNaiXjfzEA== Received: from BN0PR04CA0102.namprd04.prod.outlook.com (2603:10b6:408:ec::17) by SA1PR12MB999253.namprd12.prod.outlook.com (2603:10b6:806:4dd::13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.202.18; Tue, 14 Jul 2026 20:55:34 +0000 Received: from BL02EPF0001A0FA.namprd03.prod.outlook.com (2603:10b6:408:ec:cafe::38) by BN0PR04CA0102.outlook.office365.com (2603:10b6:408:ec::17) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.223.10 via Frontend Transport; Tue, 14 Jul 2026 20:55:33 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.118.233) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.118.233 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.118.233; helo=mail.nvidia.com; pr=C Received: from mail.nvidia.com (216.228.118.233) by BL02EPF0001A0FA.mail.protection.outlook.com (10.167.242.101) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.223.9 via Frontend Transport; Tue, 14 Jul 2026 20:55:33 +0000 Received: from drhqmail203.nvidia.com (10.126.190.182) by mail.nvidia.com (10.127.129.6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20; Tue, 14 Jul 2026 13:55:13 -0700 Received: from drhqmail201.nvidia.com (10.126.190.180) by drhqmail203.nvidia.com (10.126.190.182) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20; Tue, 14 Jul 2026 13:55:13 -0700 Received: from Asurada-Nvidia.nvidia.com (10.127.8.11) by mail.nvidia.com (10.126.190.180) with Microsoft SMTP Server id 15.2.2562.20 via Frontend Transport; Tue, 14 Jul 2026 13:55:13 -0700 From: Nicolin Chen To: Will Deacon CC: Robin Murphy , "Joerg Roedel (AMD)" , Jason Gunthorpe , , , , Subject: [PATCH v2 03/11] iommu/tegra241-cmdqv: Harden error-map index handling in the error ISR Date: Tue, 14 Jul 2026 13:55:00 -0700 Message-ID: <25ec919bb10325cac02124babdf4034f2b9dbc23.1784059577.git.nicolinc@nvidia.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-NV-OnPremToCloud: ExternallySecured X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: BL02EPF0001A0FA:EE_|SA1PR12MB999253:EE_ X-MS-Office365-Filtering-Correlation-Id: 12c0f702-8787-466c-b2b1-08dee1ea3f82 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|1800799024|82310400026|23010399003|36860700016|376014|18002099003|22082099003|11063799006|56012099006|6133799003; X-Microsoft-Antispam-Message-Info: DmZ47Ku86Q8GHLSPxxZGvo85dP9q6U+Bnm6pSbT6ADU0c3uZ9ObDlt0lC/ia+0Z1CxdAsreRNZLron1knbZdTeU5LU/pX9dZ8hGolHCdwWt248IgUYzABobwUZHiongBeOMa5n3tk9kozvZ8wjPA2uBDL7QfWFguwjH3XiKlJQ7ixfQrZFxU3ME4lnIFAMWeSEUcpL1hqVbNQ6BBbkbPprV73BIKs57vhywIAWGwK84TTghXM9qxqjfruUcZqrSN3Akonm8+5OL1NlCPOeRdAP6APoufNIEcf9l1h9pEIZjx/cueJPIRDwUKxMtzARmuruw6Fm7KJq3n0KsP3DhKAXJQ/GV+y5oskAXURX1CzHskwggpZCLgOtuwbJ1T/NTW3ia2j91HzSDCLUcL1widxn1ztE6c8xuXyCaV7CnW2CHwv2L10lXiriCET+NztBjQPhT1dAFldranN8aGgbrebSAWC/CkL78JZjN5gIPjrV3nKJrO8KMJ4HltDaH2Ph338MjHnGJ84mESOdQcqMt/JEZXg41fwvMRLPg3ZxE6tKK8hdx9Smhi28K6pwCOHLvNTWGM/8F1rk6EySDij/71LLwWTLH1ItLswueLWzEw9ifdqvGhVTN/uXd9iRSpbbnKVdqc2arYqQLhKQ9CNvYirsF0QnJqsFfpDpMbN53Dy66Z2Dp/ZpHwjo+HXd/8dt8XsFJtiu/glQ1NEkqyqbF1/Q== X-Forefront-Antispam-Report: CIP:216.228.118.233;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:dc7edge2.nvidia.com;CAT:NONE;SFS:(13230040)(1800799024)(82310400026)(23010399003)(36860700016)(376014)(18002099003)(22082099003)(11063799006)(56012099006)(6133799003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: OkuN87A/p8bbxpELZ2xUPrWqJBiqr2xkmCiLpPlySIj8KBClJv04aVVVZ/9dIKYzj6g536oKC1MVn/snR7HfEBdxXN0rt0u7fBjLJvoSt2Y0RuVTTbH6kj2v6oarphWCWqT/ntRBwytnVAR+WCJVs5CxFLH6OZblSeEM0jTw9EeRSIRwJzBSAhQzn4NgCC1RJXtQcxjAVFsekY8JqlVsekmYytjH1H9Nxhgofpq8a7M3cJHAGhFOsi53Rufes3p4S5ljW7vRha42me63k+6NcY8EO/3RoAM6M+ZA50I2zn486kgeAYJ0HJeq/FhkD0yqGlQydgh4BgyRqUruMnlHvWryN61X47T/zXd0A8/vQe4eK+fWEYTC0L5HDjMEuAmabDLtZ7svXkBsp8PvIl2gLgzs0Su/jx1oeGhmEaMpT5tIBASo3y175/nFT7lTokRJ X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 14 Jul 2026 20:55:33.5384 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 12c0f702-8787-466c-b2b1-08dee1ea3f82 X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.118.233];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: BL02EPF0001A0FA.namprd03.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA1PR12MB999253 Content-Type: text/plain; charset="utf-8" tegra241_vintf0_handle_error() reads both 64-bit LVCMDQ error-map registers but used the register-local __ffs64() bit directly as the vintf->lvcmdqs[] index. For the second register that selects the wrong queue instead of 64 * i + bit, clearing the wrong queue's error status. The index is unbounded too: a bit at or beyond num_lvcmdqs_per_vintf would walk the read off vintf->lvcmdqs[]. tegra241_cmdqv_isr() has the same flaw one level up: a VINTF_ERR_MAP bit at or beyond num_vintfs would walk the read off cmdqv->vintfs[]. Use 64 * i + bit for the index and clear the snapshot with the local bit. In both handlers, WARN_ON_ONCE() and skip an out-of-bounds index. Only a malfunctioning device sets such a bit, so the _ONCE form keeps a wedged map from flooding the log. Note that 64 * i + bit is not reachable with the current configuration as a VINTF is pre-assigned with 2 lvcmdqs, this is not treated as bug fix but an defensive hardening. Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Nicolin Chen --- drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c b/drivers/iommu= /arm/arm-smmu-v3/tegra241-cmdqv.c index 5fbc1c85874a5..b89f021ba0b86 100644 --- a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c +++ b/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c @@ -311,25 +311,30 @@ static void tegra241_vintf_user_handle_error(struct t= egra241_vintf *vintf) =20 static void tegra241_vintf0_handle_error(struct tegra241_vintf *vintf) { + struct tegra241_cmdqv *cmdqv =3D vintf->cmdqv; int i; =20 for (i =3D 0; i < LVCMDQ_ERR_MAP_NUM_64; i++) { u64 map =3D readq_relaxed(REG_VINTF(vintf, LVCMDQ_ERR_MAP_64(i))); =20 while (map) { - unsigned long lidx =3D __ffs64(map); + unsigned long map_bit =3D __ffs64(map); + unsigned long lidx =3D 64 * i + map_bit; struct tegra241_vcmdq *vcmdq; u32 gerror; =20 - map &=3D ~BIT_ULL(lidx); + map &=3D ~BIT_ULL(map_bit); =20 + /* A bit beyond the count means a HW error; skip it */ + if (WARN_ON_ONCE(lidx >=3D cmdqv->num_lvcmdqs_per_vintf)) + continue; /* Pairs with smp_store_release() publishing it */ vcmdq =3D smp_load_acquire(&vintf->lvcmdqs[lidx]); if (!vcmdq) continue; =20 gerror =3D readl_relaxed(REG_VCMDQ_PAGE0(vcmdq, GERROR)); - __arm_smmu_cmdq_skip_err(&vintf->cmdqv->smmu, &vcmdq->cmdq); + __arm_smmu_cmdq_skip_err(&cmdqv->smmu, &vcmdq->cmdq); writel(gerror, REG_VCMDQ_PAGE0(vcmdq, GERRORN)); } } @@ -381,6 +386,9 @@ static irqreturn_t tegra241_cmdqv_isr(int irq, void *de= vid) =20 vintf_map &=3D ~BIT_ULL(idx); =20 + /* A bit beyond the count means a HW error; skip it */ + if (WARN_ON_ONCE(idx >=3D cmdqv->num_vintfs)) + continue; /* The slot may be published or torn down (NULL'd) concurrently */ vintf =3D smp_load_acquire(&cmdqv->vintfs[idx]); if (vintf) --=20 2.43.0 From nobody Sat Jul 25 18:53:13 2026 Received: from CH5PR02CU005.outbound.protection.outlook.com (mail-northcentralusazon11012067.outbound.protection.outlook.com [40.107.200.67]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A3E05427F8D; Tue, 14 Jul 2026 20:55:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=40.107.200.67 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784062540; cv=fail; b=INWU67n6PwOYi/2zrZUrhoKHCugavxCKGmmElKpz+GML8jcacJQL1H2rvEMvv2Y8a5ZeVA8h+hkbbsyQBGz8o3xUOmuO2lzhSXKvLBApHeSPtMd+izblocMWARCnoQEkpVDrQsFXVcAU7f6l1VmlZfqty3hdHoNsKctVIh41j38= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784062540; c=relaxed/simple; bh=NmQ26D0DURdXUgTfoc0+/QPFXgmGm+SJTUvJE+Y/B88=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=O4RCZt/1m/L5zSckC6emL/Q6eX9aC8NNXYJ4Nqpd9OZiXI9Sb99hLFmCI5K6x+bSAeENBhl0ZLLNxs0B7pTFxIgdy8nWrovFxNOxnCbRkva4XS9uLaOH3rpRVtcQLV0HVDTsC4A+wg8iHo7XJL23EVgsPKE5N3TnjzaF92+C7Bk= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=MZr4MUcB; arc=fail smtp.client-ip=40.107.200.67 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="MZr4MUcB" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=yhnlBE430LCepyGnEpiExlNe8naIG7s4hrfj0/Spgd+Br7p7CGBcjhYklxfFN7kgyMHotl5cZo2oYMfYrQ7jrpMr/3/CVHTZK0Mbr3Iu1K7cyoM/8YzHkoWKHXVQVGSti0FXO7d4kZ5grFXrxselOv/ArIVQHeWKAxT9PgMOcsLeMp6Xunu5qIpBpwr91VcTB4N9trjs3+Ln07eM8FGuMn/fnngJlB82pGte7Q4m2eHDHdGJdhkcu/BVp5BegrLImYsJDJqiA/hislpd7xwkP8g7obp4ia2Kv2gXwmcQoa4LaBqYk6aLByAU+c7VVfaCuGWxIh0D7yEWmerjmjWNKg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=gTAQo2ZdJr7KL7ACFzpn34b6XHoSyP7nCp/LZkZwBC0=; b=OT18JKLrADuX40xSZvDeUV12wa9u2iwl2rQS3VT+QwOZv9RTlbXj7m9c665OF/PqvO9t2TVQoJ2bOA6hVgQrmKjoTdwzJ8WOxFbAKYjGRTjmbtF8BtdxAP8tGZYFAvMmYZjtoes2XBoHsZOH1VX2YAEkAfT9GpEY4e0il986KjzFCl3J1pXNAxioTNmxwBc82bKYzybhnShT5g3AjG4PtX+4Wo1hY/fcRlKXkFI4G8G4FNuienwxFmpg+2rBbHyG4kDboSPSs3yXBlBLs1OB1dWbtgZGaIqh0Yflt/YvaewDz1PTxTEDeucEGzb05oOGL6/Gk92djOn0sK/2FqUvlA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.118.232) smtp.rcpttodomain=kernel.org smtp.mailfrom=nvidia.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=gTAQo2ZdJr7KL7ACFzpn34b6XHoSyP7nCp/LZkZwBC0=; b=MZr4MUcBtx5Lfla/Wes97PLJSxViZSdxPQhwfJufIUzaQFG4Mk7DJg4VimGAQzvDaR3hw17lzBKbY+ESXjD+Oqtfhb/srYaZI8p8MJOCLyEiuW6oJ9P6qgMVRf0JzdgwXziXdTwLO6nOYrwgrtfnxktCOo5F0rg+tOrBQAygf6s94fmoFu17lAP0KFpaBEuOlBcypF0XoPe8RA4HGSNIjXvz8z6jQ6bBdOd4JexJTLRkbe+dnmmDByD9UA+GsrSXDlxRSEANYmdFjvpddcde/+ugwvUuArT4YlGmOJPWgg4KMp6LzLrtGI7E19J3ph6be/3dla4dbFMA+IR3AMQ1+A== Received: from PH8P221CA0024.NAMP221.PROD.OUTLOOK.COM (2603:10b6:510:2d8::30) by LV8PR12MB9450.namprd12.prod.outlook.com (2603:10b6:408:202::13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.202.19; Tue, 14 Jul 2026 20:55:30 +0000 Received: from CY4PEPF0000FCC2.namprd03.prod.outlook.com (2603:10b6:510:2d8:cafe::40) by PH8P221CA0024.outlook.office365.com (2603:10b6:510:2d8::30) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.223.10 via Frontend Transport; Tue, 14 Jul 2026 20:55:29 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.118.232) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.118.232 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.118.232; helo=mail.nvidia.com; pr=C Received: from mail.nvidia.com (216.228.118.232) by CY4PEPF0000FCC2.mail.protection.outlook.com (10.167.242.104) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.223.9 via Frontend Transport; Tue, 14 Jul 2026 20:55:29 +0000 Received: from drhqmail201.nvidia.com (10.126.190.180) by mail.nvidia.com (10.127.129.5) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.43; Tue, 14 Jul 2026 13:55:14 -0700 Received: from drhqmail201.nvidia.com (10.126.190.180) by drhqmail201.nvidia.com (10.126.190.180) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20; Tue, 14 Jul 2026 13:55:14 -0700 Received: from Asurada-Nvidia.nvidia.com (10.127.8.11) by mail.nvidia.com (10.126.190.180) with Microsoft SMTP Server id 15.2.2562.20 via Frontend Transport; Tue, 14 Jul 2026 13:55:13 -0700 From: Nicolin Chen To: Will Deacon CC: Robin Murphy , "Joerg Roedel (AMD)" , Jason Gunthorpe , , , , Subject: [PATCH v2 04/11] iommu/tegra241-cmdqv: Don't run the error ISR before probe sets up vintfs Date: Tue, 14 Jul 2026 13:55:01 -0700 Message-ID: X-Mailer: git-send-email 2.43.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-NV-OnPremToCloud: ExternallySecured X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CY4PEPF0000FCC2:EE_|LV8PR12MB9450:EE_ X-MS-Office365-Filtering-Correlation-Id: 2e0fc20f-8f3a-429b-8dd5-08dee1ea3d1e X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|1800799024|376014|36860700016|82310400026|23010399003|22082099003|18002099003|3023799007|11063799006|56012099006; X-Microsoft-Antispam-Message-Info: N0oU3YTP2zJ95hTsDkmK0bsBVX+Aa/bIKXPdIrsWsDAoXFo+boJ/Tj+0pfi8lKgDaLXgUhbr/R3wg69YTU6cbklMrDRyUWjOetXqMCGIwzotUzOqaarmpfQttiJ4kytl0dXkydh/TRpWUrCVnoqmxov1zX6oZk8XQiRo8qKnEXqLkCag+nGgPwLljJK83OjOboXY39XvHIXTEae8e6ZyuerccyRnbK08yu2UfMmSITRgtY3QcQXgnAy9X8TkO4EK5D27ttg65FLASd7Q+v/ZfVYXS29FHQdbgc3obNO+Y8pvCB/7EQPZuCtENU7MmK7sI0fL/xY5iIpi2fek2IAjeShOwgqyBJl+9fUlF/VoqJcbSFgbgi7LFyW4pyDZfrBCaDLj9JvD+f0MwIBFE6sUbz+58X6zSjQhG12ZBiByeio2XNo5ZTdGNxYAJCnT7exDVtc3znts6G+Q1qPjMF7iGXH4efAY9Y9YYJIzcGAePFonkV4jrzbRNQlx/aM3f/SZBbILrjzpn087K63VSLqBO1KcrFYcsNU6mRkixl/ijl8bmfU1/D1U4/KlRxzfkVDwck5khY9+Zoz8Rbryb/CBhFuQIKUi04iGUSR2Msjuq4xVJHdF1MjvzUs4dG15QKXNdIxHvkz/U+hRNApDhT6SpF/LC+JLxG9QnJYx/jcs0Jv6iTOXg9rPjwnMQhYWcG4RSDgwskTnY37HZNjLpiDWQA== X-Forefront-Antispam-Report: CIP:216.228.118.232;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:dc7edge1.nvidia.com;CAT:NONE;SFS:(13230040)(1800799024)(376014)(36860700016)(82310400026)(23010399003)(22082099003)(18002099003)(3023799007)(11063799006)(56012099006);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: JNwUwnSCMXND1xHS5CuAM13Y0ZoA2GcBz9rd9EiNCQHeX0sZIDMtCZZcRbSP3ZNsIfbsNH7vs2aFL9tYxa2JbzNsbEWB9glZFanVV7zt7Ar+pwF++UzMyELS33GXdgMTP5NI2XkmOJn7oLKOe134wD6VyNg72mnjgkZHxqOvyv6pvWhG/gHU01c7fetPXmwThB9iDLc7/rp2bK2SsbSfUF9x1qgrKC5aApRv9SE7ZA7aG2vwiGMY/2O0BfP+EzRdSW/yCSFUEHZtjxegWtzCvhGwD2ng6E3ZfJNcrjYSGrrZ2u36swgGIHlazWOqa3HLhEDPeS0lrzcZ4WjVdhFHWOwURt/UIwLMZ/ASsRSWQhrSarSisV1otX8UlUSVddII7S3PWPgm0h1YQYIfUQghzxtaPf5Ih677SkHBIoHLptnllr7S59VFBGTWL+IZUtjV X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 14 Jul 2026 20:55:29.5870 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 2e0fc20f-8f3a-429b-8dd5-08dee1ea3d1e X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.118.232];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: CY4PEPF0000FCC2.namprd03.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: LV8PR12MB9450 Content-Type: text/plain; charset="utf-8" __tegra241_cmdqv_probe() requests the error IRQ before it has allocated the cmdqv->vintfs array and set cmdqv->num_vintfs. A CMDQV left enabled with a latched error across a kexec fires the IRQ as soon as it is requested, and tegra241_cmdqv_isr() then walks the uninitialized cmdqv->vintfs array. Request the IRQ only after cmdqv->vintfs is allocated and zeroed, so that a latched interrupt firing early runs the ISR against a valid array of NULL slots that it safely skips. Fixes: 918eb5c856f6 ("iommu/arm-smmu-v3: Add in-kernel support for NVIDIA T= egra241 (Grace) CMDQV") Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Nicolin Chen --- .../iommu/arm/arm-smmu-v3/tegra241-cmdqv.c | 34 +++++++++++-------- 1 file changed, 19 insertions(+), 15 deletions(-) diff --git a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c b/drivers/iommu= /arm/arm-smmu-v3/tegra241-cmdqv.c index b89f021ba0b86..7e366030d9d70 100644 --- a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c +++ b/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c @@ -973,17 +973,6 @@ __tegra241_cmdqv_probe(struct arm_smmu_device *smmu, s= truct resource *res, cmdqv->dev =3D smmu->impl_dev; cmdqv->base_phys =3D res->start; =20 - if (cmdqv->irq > 0) { - ret =3D request_threaded_irq(irq, NULL, tegra241_cmdqv_isr, - IRQF_ONESHOT, "tegra241-cmdqv", - cmdqv); - if (ret) { - dev_err(cmdqv->dev, "failed to request irq (%d): %d\n", - cmdqv->irq, ret); - goto iounmap; - } - } - regval =3D readl_relaxed(REG_CMDQV(cmdqv, PARAM)); cmdqv->num_vintfs =3D 1 << FIELD_GET(CMDQV_NUM_VINTF_LOG2, regval); cmdqv->num_vcmdqs =3D 1 << FIELD_GET(CMDQV_NUM_VCMDQ_LOG2, regval); @@ -994,10 +983,25 @@ __tegra241_cmdqv_probe(struct arm_smmu_device *smmu, = struct resource *res, cmdqv->vintfs =3D kzalloc_objs(*cmdqv->vintfs, cmdqv->num_vintfs); if (!cmdqv->vintfs) - goto free_irq; + goto iounmap; =20 ida_init(&cmdqv->vintf_ids); =20 + /* + * Request the IRQ only after cmdqv->vintfs is allocated and zeroed, so + * the ISR would not walk an uninitialized array. + */ + if (cmdqv->irq > 0) { + ret =3D request_threaded_irq(irq, NULL, tegra241_cmdqv_isr, + IRQF_ONESHOT, "tegra241-cmdqv", + cmdqv); + if (ret) { + dev_err(cmdqv->dev, "failed to request irq (%d): %d\n", + cmdqv->irq, ret); + goto free_vintfs; + } + } + #ifdef CONFIG_IOMMU_DEBUGFS if (!cmdqv_debugfs_dir) { cmdqv_debugfs_dir =3D @@ -1012,9 +1016,9 @@ __tegra241_cmdqv_probe(struct arm_smmu_device *smmu, = struct resource *res, =20 return new_smmu; =20 -free_irq: - if (cmdqv->irq > 0) - free_irq(cmdqv->irq, cmdqv); +free_vintfs: + ida_destroy(&cmdqv->vintf_ids); + kfree(cmdqv->vintfs); iounmap: iounmap(base); return NULL; --=20 2.43.0 From nobody Sat Jul 25 18:53:13 2026 Received: from SN4PR2101CU001.outbound.protection.outlook.com (mail-southcentralusazon11012030.outbound.protection.outlook.com [40.93.195.30]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DC78B429CDD; Tue, 14 Jul 2026 20:55:40 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=40.93.195.30 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784062546; cv=fail; b=pHP/UM9pH/DbJZsl020zqrn0m19nse7jIZ6WOATjBzl0WVg8B5YW9L9wexjuyksEp1NdqPiQPEZOnGD9chYDO6rYuxdioCJli6YiP+9o9lujXEJbKBAyHugGB9Gn6/OYaXY1/+s/rSMAlLnRuMxxUZWYhlH/71m3qppiSRihkto= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784062546; c=relaxed/simple; bh=LOGeWng4ulWNRJ4YLYEVYCfG96wBMHK2Ns5paR2koWA=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=dsdYJBmkO0dE8Znu0ibytPV7a2dRk0aHstdjd9PdbfBo18SYQjA2tUkORayh/zGxp6ladmPa8yWe7v2h0NpHFqsjjZkyQySR/RUCk62wpRqLhE0LGAQoQf4TNS/OQ1qbkkIhSdZ8/1+ISMbHXbqRwpdDpc+Us5ZHmFkewhPJVqs= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=jy7dxwq1; arc=fail smtp.client-ip=40.93.195.30 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="jy7dxwq1" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=YQBxFafS9o5YYL50z9GxcraqBI/trfrySj/Cp8wcCZUGL3joMvpRDajtbIOe3erfSC/eScnS5YIqqNUBZSwAqzy8AM/SeFSajbO+cR1oCmeFin1phiYtk/IJP+edccfxv3q0XJkDYe1g2LiFebILzg7go4hvcPWorLc7R/yzL6FTDrw+LI19hAmm26vosQZIaX8h3r0YB/u2+EklW/6VriZQ/IXTuqe+kqUgf/dbx1Fcry6TX3FnpK4HX5PfdCeBgKaM+P6I1jvVv9aVM7+E0bg75/SMFrnNXT9z2GBb9XsMQRRciv+VlIEMVy7FVEgxaY4VVeGa7AlvVkgpmLOOyA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=D60KOzU+x046LlW+N6Byta9VYld6RxG3Tnde/knXFJE=; b=nzbAj67axmWmOqRwzUj7KPdQP2ymOH8RDgCi0Fx0bfQDJWkMja7fE1nzi2bpuBcl9ktXl/pM/shTSOkvbFAZEe6pJs0R3lTE3Tnz4qMVR0WhzWiQbsMb16t5WuJ4dwF/fBbflKQJDKd8G3xs0TEq2DYZbm6Qk9ge/8IXIFZiVVXyfIWBJqxVCeyXxF4gJRRai+PAWrpLDL35clyzXna3tNvLTG/UmVFY1XzQsAjKrMvvGrYnW8bL3lded7f/1YPzfB2aWNZFns2rYYBWOpSZ2//4SDjLUQ8qDaq3tknti4X2tWdOZboG3VlcS0vbLXuCCnlgNCQc1Iju6pUzlUzZvQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.118.232) smtp.rcpttodomain=kernel.org smtp.mailfrom=nvidia.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=D60KOzU+x046LlW+N6Byta9VYld6RxG3Tnde/knXFJE=; b=jy7dxwq1hW3JaUh0OhRtpqqJ8W06PxZ7okCllnvr1AiuufRoHwQb7oln5S56FsoVQ4V8SBSE/5EYqLuJYRts/J/KFmsC/oFtA+JYA+95GtoVVVGhCbfAkl6noU68D9vByCHyTJTyaDUJIeLYMLkH54Up5mCUBvKxr9i5Cl8KXh+SUP+wrBC3OaAb0tjZZX+oC5IMEb9b04pJSXbg3T0FCO5LBnNr+OBV/C5uHe6KmlrnIwNjLU/cJ9YxvZTZW/qzo6DQQT7nXwhj9txCrdTDBscWGdQPwCLBM8FJW2UOnoh3/v3+3UFLTWlrJj4AQ86UEhMRCXbxKj3Ov42BaEpZ8w== Received: from PH7PR17CA0037.namprd17.prod.outlook.com (2603:10b6:510:323::28) by DS7PR12MB5959.namprd12.prod.outlook.com (2603:10b6:8:7e::21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.223.9; Tue, 14 Jul 2026 20:55:32 +0000 Received: from CY4PEPF0000FCBE.namprd03.prod.outlook.com (2603:10b6:510:323:cafe::92) by PH7PR17CA0037.outlook.office365.com (2603:10b6:510:323::28) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.223.9 via Frontend Transport; Tue, 14 Jul 2026 20:55:31 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.118.232) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.118.232 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.118.232; helo=mail.nvidia.com; pr=C Received: from mail.nvidia.com (216.228.118.232) by CY4PEPF0000FCBE.mail.protection.outlook.com (10.167.242.100) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.223.9 via Frontend Transport; Tue, 14 Jul 2026 20:55:31 +0000 Received: from drhqmail203.nvidia.com (10.126.190.182) by mail.nvidia.com (10.127.129.5) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.43; Tue, 14 Jul 2026 13:55:15 -0700 Received: from drhqmail201.nvidia.com (10.126.190.180) by drhqmail203.nvidia.com (10.126.190.182) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20; Tue, 14 Jul 2026 13:55:14 -0700 Received: from Asurada-Nvidia.nvidia.com (10.127.8.11) by mail.nvidia.com (10.126.190.180) with Microsoft SMTP Server id 15.2.2562.20 via Frontend Transport; Tue, 14 Jul 2026 13:55:14 -0700 From: Nicolin Chen To: Will Deacon CC: Robin Murphy , "Joerg Roedel (AMD)" , Jason Gunthorpe , , , , Subject: [PATCH v2 05/11] iommu/tegra241-cmdqv: Don't fall back to a freed smmu after devm_krealloc() Date: Tue, 14 Jul 2026 13:55:02 -0700 Message-ID: X-Mailer: git-send-email 2.43.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-NV-OnPremToCloud: ExternallySecured X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CY4PEPF0000FCBE:EE_|DS7PR12MB5959:EE_ X-MS-Office365-Filtering-Correlation-Id: ae5ecdfc-ed34-490c-b8a6-08dee1ea3e25 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|23010399003|1800799024|36860700016|82310400026|376014|18002099003|6133799003|22082099003|11063799006|56012099006; X-Microsoft-Antispam-Message-Info: 0YsVnIfoEN4CobQUDtKT2mXRgMbMM2Kg+YNolMIc/ruKOBWWNb4GnqUzTrVrnqcNXh7wQTT7m4OdF5BXNWpL2tDNBDDZN+QurRiWDGRnso34BCcEJBpxd4wM3afQda7fExeavlfQNopCexuo/NK6pq9LIpl41VemSD2YuBCMplIsTyaSEZHdq1b2KSTsNw+GWLNYvHpCm+3O2rxhcV35whsMIM6JagEV+20KQs/D7jNCjUcqfaBWf1TExZt/plWLYue6RoFOz/MIaMg3kNDIFa7hIRxgs366dKXrYy08U3ZzZFLre8AqSA17oddNBaBqYMW1nBpUQFmHE6aZ8pG6yDS6EPIbNKL+9tlUMJvuPPR/HDQwsC8wy/56Wk3FJI4wmVzBVEiSSlQ6bwS7aO1GZBFuwLKFVWfEuxFZKbbWAZV8mfe1UlyQQjUdv2jVf6MazLUBOE1BSy9Vi/pnwq7izuck7a0BIY85tHphSUvHXh9Kc0nyRrC1dHGqKwacVcYQyi453ZVfi4l1AhN4xflW3PCvoG3d0jbSS9fHfq9TK0VRiU9+9DOlZNqIbM6LNJcj8oBQCPNP6rRVmpFKOGxQ163DzHH1gWRIjtZrasKXKeg6JAp9r4VJ5erMCtt67Ydr4zfYcLPI/PKsWWBKrqJXSLKgmzcmRAcDUDJmLN3ET9jj6WZ8sph+ewadBvc2l3EJijYATDfl3AIBr/rmCXJLWA== X-Forefront-Antispam-Report: CIP:216.228.118.232;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:dc7edge1.nvidia.com;CAT:NONE;SFS:(13230040)(23010399003)(1800799024)(36860700016)(82310400026)(376014)(18002099003)(6133799003)(22082099003)(11063799006)(56012099006);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: zqYWjo/8UfUR1XgNc0FE58UzU0FPOMXhNIlw2x0Xl1A8v0cJ7kmbhnMiFMUBiwTxw2X9x8fdB3ZQ2OqYFEPFV6ltc7hyxLoe6LEdaeS13PqEBK0x90KlaeAgN5Eae0baa0mrb8xZtv1E5QJ4HgkEFI6dP3pIzKdbYrFdAW9wV+hiQL8TVpw9OxeOzzOPmUQnz3MVjcXXeNQZkfAsMpAVb0+ML3Zzcft28vp9rgPT7XgsmMbHhTuOIDe3AvCoZJSXU//xuppWWgFrazHF/XetocIO9j7xo0FU7QfF+Qd2BGxOQsw2T7yKm8izWkOc90iyl9XaH26FSZW9lKJSgGF0lUULw3rQ+xvD+y4gikkfjZfTm07IDNp/4ohDC9GTiq15gTFOiszkhf/u9P3s1mOTTrRsZx4WNKMa06dshN7TWdsQsKVz86s+04pyhwCmyiOv X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 14 Jul 2026 20:55:31.3122 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: ae5ecdfc-ed34-490c-b8a6-08dee1ea3e25 X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.118.232];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: CY4PEPF0000FCBE.namprd03.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: DS7PR12MB5959 Content-Type: text/plain; charset="utf-8" __tegra241_cmdqv_probe() uses devm_krealloc() to grow @smmu into the larger tegra241_cmdqv, which frees the original @smmu once it relocates. A failure after that returned NULL, and the caller then dereferenced the freed @smmu on its fallback path. Return an int and take @smmu by reference instead, then update *smmu to the reallocated pointer after devm_krealloc() succeeds, so the caller and its fallback path both use the live @smmu rather than the freed original. Fixes: 918eb5c856f6 ("iommu/arm-smmu-v3: Add in-kernel support for NVIDIA T= egra241 (Grace) CMDQV") Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Nicolin Chen --- .../iommu/arm/arm-smmu-v3/tegra241-cmdqv.c | 54 +++++++++++-------- 1 file changed, 32 insertions(+), 22 deletions(-) diff --git a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c b/drivers/iommu= /arm/arm-smmu-v3/tegra241-cmdqv.c index 7e366030d9d70..262798cd6b8a8 100644 --- a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c +++ b/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c @@ -934,16 +934,22 @@ static int tegra241_cmdqv_init_structures(struct arm_= smmu_device *smmu) static struct dentry *cmdqv_debugfs_dir; #endif =20 -static struct arm_smmu_device * -__tegra241_cmdqv_probe(struct arm_smmu_device *smmu, struct resource *res, - int irq) +/* + * Probe the CMDQV and reallocate @smmu into the larger cmdqv->smmu. + * + * devm_krealloc() may relocate and free the original @smmu, so update *sm= mu to + * the new pointer once it succeeds. The error paths after it do the same,= so a + * caller falling back keeps a live @smmu instead of the freed original. + */ +static int __tegra241_cmdqv_probe(struct arm_smmu_device **smmu, + struct resource *res, int irq) { static const struct arm_smmu_impl_ops init_ops =3D { .init_structures =3D tegra241_cmdqv_init_structures, .device_remove =3D tegra241_cmdqv_remove, }; - struct tegra241_cmdqv *cmdqv =3D NULL; - struct arm_smmu_device *new_smmu; + struct device *dev =3D (*smmu)->dev; + struct tegra241_cmdqv *cmdqv; void __iomem *base; u32 regval; int ret; @@ -952,25 +958,28 @@ __tegra241_cmdqv_probe(struct arm_smmu_device *smmu, = struct resource *res, =20 base =3D ioremap(res->start, resource_size(res)); if (!base) { - dev_err(smmu->dev, "failed to ioremap\n"); - return NULL; + dev_err(dev, "failed to ioremap\n"); + return -ENOMEM; } =20 regval =3D readl(base + TEGRA241_CMDQV_CONFIG); if (disable_cmdqv) { - dev_info(smmu->dev, "Detected disable_cmdqv=3Dtrue\n"); + dev_info(dev, "Detected disable_cmdqv=3Dtrue\n"); writel(regval & ~CMDQV_EN, base + TEGRA241_CMDQV_CONFIG); + ret =3D -ENODEV; goto iounmap; } =20 - cmdqv =3D devm_krealloc(smmu->dev, smmu, sizeof(*cmdqv), GFP_KERNEL); - if (!cmdqv) + cmdqv =3D devm_krealloc(dev, *smmu, sizeof(*cmdqv), GFP_KERNEL); + if (!cmdqv) { + ret =3D -ENOMEM; goto iounmap; - new_smmu =3D &cmdqv->smmu; + } + *smmu =3D &cmdqv->smmu; =20 cmdqv->irq =3D irq; cmdqv->base =3D base; - cmdqv->dev =3D smmu->impl_dev; + cmdqv->dev =3D (*smmu)->impl_dev; cmdqv->base_phys =3D res->start; =20 regval =3D readl_relaxed(REG_CMDQV(cmdqv, PARAM)); @@ -982,8 +991,10 @@ __tegra241_cmdqv_probe(struct arm_smmu_device *smmu, s= truct resource *res, =20 cmdqv->vintfs =3D kzalloc_objs(*cmdqv->vintfs, cmdqv->num_vintfs); - if (!cmdqv->vintfs) + if (!cmdqv->vintfs) { + ret =3D -ENOMEM; goto iounmap; + } =20 ida_init(&cmdqv->vintf_ids); =20 @@ -1012,24 +1023,23 @@ __tegra241_cmdqv_probe(struct arm_smmu_device *smmu= , struct resource *res, #endif =20 /* Provide init-level ops only, until tegra241_cmdqv_init_structures */ - new_smmu->impl_ops =3D &init_ops; + cmdqv->smmu.impl_ops =3D &init_ops; =20 - return new_smmu; + return 0; =20 free_vintfs: ida_destroy(&cmdqv->vintf_ids); kfree(cmdqv->vintfs); iounmap: iounmap(base); - return NULL; + return ret; } =20 struct arm_smmu_device *tegra241_cmdqv_probe(struct arm_smmu_device *smmu) { struct platform_device *pdev =3D to_platform_device(smmu->impl_dev); - struct arm_smmu_device *new_smmu; struct resource *res; - int irq; + int irq, ret; =20 res =3D platform_get_resource(pdev, IORESOURCE_MEM, 0); if (!res) { @@ -1042,15 +1052,15 @@ struct arm_smmu_device *tegra241_cmdqv_probe(struct= arm_smmu_device *smmu) dev_warn(&pdev->dev, "no interrupt. errors will not be reported\n"); =20 - new_smmu =3D __tegra241_cmdqv_probe(smmu, res, irq); - if (new_smmu) - return new_smmu; + ret =3D __tegra241_cmdqv_probe(&smmu, res, irq); + if (!ret) + return smmu; =20 out_fallback: dev_info(smmu->impl_dev, "Falling back to standard SMMU CMDQ\n"); smmu->options &=3D ~ARM_SMMU_OPT_TEGRA241_CMDQV; put_device(smmu->impl_dev); - return ERR_PTR(-ENODEV); + return smmu; } =20 /* User space VINTF and VCMDQ Functions */ --=20 2.43.0 From nobody Sat Jul 25 18:53:13 2026 Received: from DM1PR04CU001.outbound.protection.outlook.com (mail-centralusazon11010026.outbound.protection.outlook.com [52.101.61.26]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9481B427F8B; Tue, 14 Jul 2026 20:55:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=52.101.61.26 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784062539; cv=fail; b=l5iPDJaqYrcRHGYHFx3vNhrp3GCX28drJ8C08Hu51aSIT8ip9vA3Hhmsp4lCWdMdcuMMBQ1uh+MDWqcr/L00o3zas/pydy8L6KKsR1DmNjLoQ0yDRfNThLuyKJpx15nEte6VwMfbVHzYoA8q5cTwaqML1vYtkLRdMnvPZhUKgIg= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784062539; c=relaxed/simple; bh=Urbg6QUsvaHws4O9rajkpTDDHewVWE849Im+8P6nDqc=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=HY0AfEdKOJf/BY1dxwgxxQp8jCXiTAHNCgAZLJ2HWOrxRJo1ozqaWCTLnQ/2wFOCLwpmOK+aymgTlKGr0GL3LcnfxSIso2wYAoBzadhrUmg5Z9x8w5+pgKOV3NZSH/G4NHw9buHR7K268PwkvbDziaUqAQNZW0VUlyN60D/fN9A= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=tMFGoZAg; arc=fail smtp.client-ip=52.101.61.26 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="tMFGoZAg" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=YbGAzWIBWHV1JdVUhgzy6GGzj8wh5/P4Lj0b0i2T5HwCWEcBNEg8CKNyFlz7jjf6z9zbzGtafKWPfrDQWKG2k4HmhUzitMjPcGHXX23k2tVvKWLE2ufK75G228DrbXr4P6rcyosF3t07CKjwz/YrKGrDlUwpDY+8gRXi+K2hX5SRTGOwGGgvqIADurlS73mw6di7fcF8doBjO/Cgjd9cmNAtCa5+natsf0Dtgr7P3u87gNnBCeeEPFwZqyEhHjYVT7IR+XqOxbgq8w0ad5zhF1WC8IzsJQ1T7vBSbFvxkSRuTkBlWhXDM30WMS3v+HkpL0x0y97XgssueTIV+a0uiA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=Bdn0PEMO559eGmJIGVgBPlKC/Zz31FDwlfVkx8vP6oc=; b=KEO8ypnx7p7qUYb/Z78lJ4YXE4eGwiwtfPedAC4vyUaP0eQXHG+7zVPn7pY6NIHspIDcITI7Wj87g89xFLNvybGZTqqHmhP8hRwfoVdKYcv+e+82y/zGTAvBpJBJdNH+b20ZYnVnn1eynEsgU2E35z1VbhJkiA3y4EeqGuN8OwDyPhM5ddn4In6zbb6+8pQyeLJ6YdFVvMZlxs4PoeyPJbXYYIER8+541K6Lh6QndYxSrm+RXe60VKNl7+k1sweI0HgnvmQbhlbOd1KwA81BfOZ3PmGFBY5uht0hktKovXR/zMXnNUphBm/syV4TjDTzMAwXYXjJfvmcy5h2KiB1ew== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.118.232) smtp.rcpttodomain=kernel.org smtp.mailfrom=nvidia.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Bdn0PEMO559eGmJIGVgBPlKC/Zz31FDwlfVkx8vP6oc=; b=tMFGoZAgwfiE/AdyT6kgIDvxhGlRb2gbLsG8RcLoJF5jfErfj7Fh+VJZixRJqH+oVbJ+fkeEC4Y3Oj8mooFmUqmDqUlJfDl18sV+tVUkEeb13e1KO4Vv17BY72165n4goUxRLl0DXASiwvdEiVdL+9ryo5QZcmG3FhqEme6Vm+M1rhtlETnNaAgPbCZvQU3OcYD4sjU/q60ke/6uRpbhzeDCpWSLs2dA52oeN+4H9bse/lfMXgnEvgItFDD2BBEHBDGHmH0lFPpYnOXPZL0ZnND/Th9c+MmV3jSYIUJ00N18hHqZfkQNimu9+vY1QvnrAqGAiCF73NLYRbGkTDEbwQ== Received: from PH8P221CA0022.NAMP221.PROD.OUTLOOK.COM (2603:10b6:510:2d8::7) by BY5PR12MB4242.namprd12.prod.outlook.com (2603:10b6:a03:203::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.223.10; Tue, 14 Jul 2026 20:55:33 +0000 Received: from CY4PEPF0000FCC2.namprd03.prod.outlook.com (2603:10b6:510:2d8:cafe::3) by PH8P221CA0022.outlook.office365.com (2603:10b6:510:2d8::7) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.223.9 via Frontend Transport; Tue, 14 Jul 2026 20:55:33 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.118.232) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.118.232 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.118.232; helo=mail.nvidia.com; pr=C Received: from mail.nvidia.com (216.228.118.232) by CY4PEPF0000FCC2.mail.protection.outlook.com (10.167.242.104) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.223.9 via Frontend Transport; Tue, 14 Jul 2026 20:55:33 +0000 Received: from drhqmail203.nvidia.com (10.126.190.182) by mail.nvidia.com (10.127.129.5) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.43; Tue, 14 Jul 2026 13:55:16 -0700 Received: from drhqmail201.nvidia.com (10.126.190.180) by drhqmail203.nvidia.com (10.126.190.182) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20; Tue, 14 Jul 2026 13:55:15 -0700 Received: from Asurada-Nvidia.nvidia.com (10.127.8.11) by mail.nvidia.com (10.126.190.180) with Microsoft SMTP Server id 15.2.2562.20 via Frontend Transport; Tue, 14 Jul 2026 13:55:15 -0700 From: Nicolin Chen To: Will Deacon CC: Robin Murphy , "Joerg Roedel (AMD)" , Jason Gunthorpe , , , , Subject: [PATCH v2 06/11] iommu/tegra241-cmdqv: Free the error IRQ before tearing down VINTFs Date: Tue, 14 Jul 2026 13:55:03 -0700 Message-ID: X-Mailer: git-send-email 2.43.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-NV-OnPremToCloud: ExternallySecured X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CY4PEPF0000FCC2:EE_|BY5PR12MB4242:EE_ X-MS-Office365-Filtering-Correlation-Id: 1cfc2ad3-a4ee-4016-fa88-08dee1ea3f2a X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|82310400026|36860700016|23010399003|1800799024|376014|18002099003|22082099003|11063799006|56012099006; X-Microsoft-Antispam-Message-Info: S2onWIRPHHkTfjrIujNCkd4VY47Xvz2X2fwzw/MGZQy2NNoqZHa5wOBQLLbsyDGnCtJHTDp6sNdBdwqU42tIlDiVSHgyl2PyaZHtq4cZJ5/tk7Nn8lW9fKcaExr7Gl5I0TFZkI68VbWJbMZhLD7qjzqTKbV7s3AK+z8d9HACcieHFZrJsDAjfWhLc5nU2K87SDjxaPpW3WGQEejln8Aoytiv4emF1A3JFWvtKtjJ+ZQtWIkkAEL38bTcXJEm5kyHDWUkKgEewHcJzb+4FK8/hIlZyBe/8QySZWLZvJubqFpY8MFE28DCNaNRWh/fFMo4OFAzPw3B8qlM0tMbQnalXGynnCE9EM6XF9nEQ8o5aFWXmPV9yQtqURLGng2Jmdo8+fLLbeBb4rciIxvt6Y2lIEZwPCybO9SIMSUN/I0nCALcMmjSW2qdH7REKSTTxWu9/d5tNehfjZgOLAfNdxPci3OmscOU0+Mb7+CGMDI3LPIaW59G2Q3+KThruYNT5mKslOyfE0gfjQelu+sC2qy7Usvr18zsoiPM2CbBpsUE0Z+x1v18OH48cTFlELDjwfbvby9cGOOvjrHyBFySHYUOQMkYcYcew+3By7e85QeHge1VtICNfnNBPpyvsUVLmXkIkajES2pV0WlBmZLDarKJmd+vWCpLaN+Ws90WpwqW5gt1Of6Bc7zdsIgYUG4kmZW8kD/EUbLEBbp9C0Ly95W6aQ== X-Forefront-Antispam-Report: CIP:216.228.118.232;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:dc7edge1.nvidia.com;CAT:NONE;SFS:(13230040)(82310400026)(36860700016)(23010399003)(1800799024)(376014)(18002099003)(22082099003)(11063799006)(56012099006);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: pXsceft1IxArnQqEH82EXO046zb5Mm7x6RQFETc0KvXXfLv/2+LgGJu7gSgtX9Hx74c/9mAsanxaqoyhlSvjt4RkcF/NTQ7Jzpbl5Yit1u08EFZAXY555q/oZy86mD/DHAhoXbLQL6bFA6K79dNgZdJpmS8zm2lXn9uqi+BYWIroEU7CAsExKweHg7CK4QEayS6tahKSTyiGf9z4Gn9Rp3kkOsLjRevd5xqe5OLR1k7iMbl3DngNYsAi5cocvqOjMqdzNT//Q0c57kWBEYepp/d9OC7ILhqYHqtSC2jlIFbpaAbU42cmVFmVM1aYLhXdM3Oy9xyQyFtHYi1HSPY0rVbblS61dgtSc2PsW8m6dCeQXT8tygBLu1OXQnOUFpnPqKsa4jE+wuy1X7lFEaS56ko//s2CewX56ZsAObm/UaWGQRpU0I9MwxpbwLpZ7PjZ X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 14 Jul 2026 20:55:33.0163 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 1cfc2ad3-a4ee-4016-fa88-08dee1ea3f2a X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.118.232];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: CY4PEPF0000FCC2.namprd03.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY5PR12MB4242 Content-Type: text/plain; charset="utf-8" tegra241_cmdqv_remove() tears each VINTF down first, then calls free_irq(). Tearing a VINTF down frees vintf0 and clears cmdqv->vintfs[0]. An error in that window makes tegra241_cmdqv_isr() read the stale slot and hand it to tegra241_vintf0_handle_error(), which dereferences a NULL or freed pointer. Free the IRQ before tearing the VINTFs down. free_irq() waits for in-flight handlers to finish and blocks new ones, so no ISR can observe a VINTF as it is torn down. Note: a user-owned VINTF (viommu) could outlive this teardown, which unmaps cmdqv->base and frees cmdqv->vintfs, so a later viommu close then touches freed memory. This is neither introduced nor fixed here: a physical IOMMU is not a pluggable device, so iommufd by design holds no reference on the one behind a viommu, and this teardown is not expected while that viommu is still alive. Fixes: 918eb5c856f6 ("iommu/arm-smmu-v3: Add in-kernel support for NVIDIA T= egra241 (Grace) CMDQV") Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Nicolin Chen --- drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c b/drivers/iommu= /arm/arm-smmu-v3/tegra241-cmdqv.c index 262798cd6b8a8..fbf7ecf043a8c 100644 --- a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c +++ b/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c @@ -829,6 +829,14 @@ static void tegra241_cmdqv_remove(struct arm_smmu_devi= ce *smmu) container_of(smmu, struct tegra241_cmdqv, smmu); u16 idx; =20 + /* + * Free the IRQ before tearing down the VINTFs. free_irq() waits for any + * in-flight tegra241_cmdqv_isr() to finish and blocks new ones, so the + * ISR cannot dereference a VINTF that is freed by the loop below. + */ + if (cmdqv->irq > 0) + free_irq(cmdqv->irq, cmdqv); + /* Remove VINTF resources */ for (idx =3D 0; idx < cmdqv->num_vintfs; idx++) { if (cmdqv->vintfs[idx]) { @@ -841,8 +849,6 @@ static void tegra241_cmdqv_remove(struct arm_smmu_devic= e *smmu) /* Remove cmdqv resources */ ida_destroy(&cmdqv->vintf_ids); =20 - if (cmdqv->irq > 0) - free_irq(cmdqv->irq, cmdqv); iounmap(cmdqv->base); kfree(cmdqv->vintfs); put_device(cmdqv->dev); /* smmu->impl_dev */ --=20 2.43.0 From nobody Sat Jul 25 18:53:13 2026 Received: from SJ2PR03CU001.outbound.protection.outlook.com (mail-westusazon11012052.outbound.protection.outlook.com [52.101.43.52]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CEDC8427FB1; Tue, 14 Jul 2026 20:55:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=52.101.43.52 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784062547; cv=fail; b=rqc7I1iOWWoy/gua/6du7XXGQHSW9JWqtQJgf/Fgg5HiJythSAZ7bh93F/4Z5N/41Mm8SOG9HNQw8eegjnMfCKT4JJyGiFVAOWH6G1hV+biKmPXKGcFVe/o10kkw84wjtjnBWfJQqqvjLKYnh4YDDaNyK120vg+UM3s5qWQQbIg= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784062547; c=relaxed/simple; bh=XXjBO3fCtJ8pV/FjkM4tmLF3aG4NBkBa+vYv6T6qw0k=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=YF6Ig4g/URXaUHSzO3HLe+82TJE09gLaJXIzRrbnRx20pEVS8L5e4/x48tieaC8EDg/hj4hTdpL2cE2m6quz8GDAehuhSDJoD2pmE4z6YrwZzvT+j2EHaycqV+k08wx2D0H4xwQqwMyp5vMAEsujEeXYaiWWQ+ttv3HS2RVzdr4= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=nd5xDFB4; arc=fail smtp.client-ip=52.101.43.52 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="nd5xDFB4" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=cxO2cV0dwS8QlS0tNVZE6oxKRQ00wovfRpfhPP/+9zzaaMCVGcEoMJrrFF+kPAlEbcbVBRS8qPd+5vtDu2J8DOBlOarfp1gcbay8uDHn3Hl+EaIp8NCx5Jrrf7jbhVJFcyUgi9mddC/bka2yY13GKb+rqwTuEPkzVne4yGMurInWps5TJGIGdP3viMfNeX2lx0zzgJjdzX3yL/GJBFHhnzTcUgN81ce34K+vC+2/K4tUlSEcSqJGrq1dVBuv36VfiSIp+LP2Olzyxg8PNolZsbDNGC4h3f0MaVMeo0ahny/Z8VlZPKaEV/3i8q/RRo0kJLWK70f34ASNu+69/tpE6Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=gb2OczpIKYaIK1PP5Qu02iBDQ0Tamghwba5pckLeWic=; b=yA7qUWuTBgQSN6qg26+kDcm9p9oV13zwiclNe2k5hgzHJjdSy4ys/npy6ADlDALLoCO4VTLco8y4P6X7l43ibXF2SAVSsBvvtHaINb4pEusnWfpr5o/qqAl+y1GTUHr3El3bxzagiTCu6zo9qB/JyiSzmR6IQUoKAGxIPAK2EC2UM+5uudKDkxSasjcDP2zRweLkz5clooXmXRs83Lm7ztFvJf9hXhrmHk8OGFT2YGdIOflSW639lCW8F5H0Xh7QVfPvhR0vMVUub/8cMwlUhLzaceGq/iGBhfgoR1BwvvbhvjsqezwpXjboiYdSY8s/JUZsytoHDNGLa0CuLfN0lQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.118.232) smtp.rcpttodomain=kernel.org smtp.mailfrom=nvidia.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=gb2OczpIKYaIK1PP5Qu02iBDQ0Tamghwba5pckLeWic=; b=nd5xDFB4akAx1xZtCtbQBhEj4lqksn97KIFZ0F8ot2mtm4papZ+R6q+fZ1xfGeSIFacMtnVBV2rm7S7jqu5Wbx7UEUhyK2anBoXBQHz3l8nVla5fqpdMTmyhe1B+1u9ROc/syJHR09YYIcDD7PRni+GxU0scQhVPEV1eUBgLhCMThn3CSGpl5zuF04A4KkfdKbndESVvCpHBqL/47l8YfVO8wCExqshamtgOeM6Asy1UTp6bPZ6rxM9dZ4YoVu/Vm8U5z03kaSiB0M4pMVB9gbFuuaJpycIQ+y8+hvGKaVxUZmSjJSo1opoCGzZJ4rj1quU4WpfX4+ORuV7jX86x9w== Received: from PH7PR17CA0047.namprd17.prod.outlook.com (2603:10b6:510:323::29) by DS5PPF016FC81DF.namprd12.prod.outlook.com (2603:10b6:f:fc00::644) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.202.18; Tue, 14 Jul 2026 20:55:38 +0000 Received: from CY4PEPF0000FCBE.namprd03.prod.outlook.com (2603:10b6:510:323:cafe::98) by PH7PR17CA0047.outlook.office365.com (2603:10b6:510:323::29) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.223.10 via Frontend Transport; Tue, 14 Jul 2026 20:55:35 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.118.232) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.118.232 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.118.232; helo=mail.nvidia.com; pr=C Received: from mail.nvidia.com (216.228.118.232) by CY4PEPF0000FCBE.mail.protection.outlook.com (10.167.242.100) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.223.9 via Frontend Transport; Tue, 14 Jul 2026 20:55:35 +0000 Received: from drhqmail202.nvidia.com (10.126.190.181) by mail.nvidia.com (10.127.129.5) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.43; Tue, 14 Jul 2026 13:55:16 -0700 Received: from drhqmail201.nvidia.com (10.126.190.180) by drhqmail202.nvidia.com (10.126.190.181) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20; Tue, 14 Jul 2026 13:55:16 -0700 Received: from Asurada-Nvidia.nvidia.com (10.127.8.11) by mail.nvidia.com (10.126.190.180) with Microsoft SMTP Server id 15.2.2562.20 via Frontend Transport; Tue, 14 Jul 2026 13:55:15 -0700 From: Nicolin Chen To: Will Deacon CC: Robin Murphy , "Joerg Roedel (AMD)" , Jason Gunthorpe , , , , Subject: [PATCH v2 07/11] iommu/tegra241-cmdqv: Reject a vSID wider than the SID_MATCH field Date: Tue, 14 Jul 2026 13:55:04 -0700 Message-ID: <3cf17b4f317a6b9dff6dc2cffed24b069d310f1f.1784059577.git.nicolinc@nvidia.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-NV-OnPremToCloud: ExternallySecured X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CY4PEPF0000FCBE:EE_|DS5PPF016FC81DF:EE_ X-MS-Office365-Filtering-Correlation-Id: e803bc18-caa9-45e1-ca0e-08dee1ea4064 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|23010399003|36860700016|376014|82310400026|1800799024|6133799003|56012099006|11063799006|18002099003|22082099003; X-Microsoft-Antispam-Message-Info: i71lnoNQ6aSy3rkw0DVCCaQ2QSBZC8lXvszQUsHZvq2c0QvEDWqkHkN1KAvCKG1ZeDymwzcdmvCszt5+vWFqTUdaAACnRBVdPepHeQKOvBTJ7aBufWn2wSWDK+MTYE5wmvu3lF+bqf6/0W65/FfFjrSdF09K8+W/HW7mBLS0QFwRAAqYhGiJcAXeVn1Ic0eNZ+CJCW6w0mjnboKDYnVKv8NY2R7vPR+3XQTAyi48Whhpv8IwaRDkiXSbvdVZNyXiGxgL8Momjjz6Zf0PPf3/61ejpaXBJGDTjNq5dW3jjjNopJm5Vn1yTO3ZAZ0uLRZyI/CfeZ//9+af7TZdIsUtZ1IriubZ4vzchomSftUN0xi58F90CGP3thDRd14LIPl1CD/Cr+gRDSo9jm4wl6tCMeVdMbOeeu4Cl1YxUiZ/OZQA910aJ/S0QjQPU1GKvlQHCfV4ANhzuy0p6Ewu6m0uYYhqLxOD8IngLKVtnaYCIgxhnZfaq8hLDWmHTSzC4woDEB8qi+HBwoGBVUsEpMpc1KJjVwxPbqF79leGY8EnocDxRm1o3TR6S+Cz9B4/6TI63Fc8+CCYUg2O/tAj46s83huFQkzxekOQqrp3CmFRk4vjo3NZbZeo/5qh0EiGYQeaZ2oaPuEWxlNGPfkZDTa8nIc1I9GbvXebCAvxFkG9KotvRO01SLhzLaQF1e6+oyJ33atjp67Prf7p4Z8zhO950A== X-Forefront-Antispam-Report: CIP:216.228.118.232;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:dc7edge1.nvidia.com;CAT:NONE;SFS:(13230040)(23010399003)(36860700016)(376014)(82310400026)(1800799024)(6133799003)(56012099006)(11063799006)(18002099003)(22082099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: OEolRh30qZp2j5bWfWjBjiO+Z01lvXGp+YWn6DLRInT9hv7Cm0DokA5pRO6xVnIRg4mrTfemYCLYbiQkFGWpbLRiBxWXQQM8/lUXTbYi1K88vgh04WiFWusXwG/VW20mEj+oBxdOp88WMMCBXmfJKGHIQyiVxmITCW83g5+qV4x7t+krnZJOJh5OoXQdfLEAD2wEOjq98leBAl3aRlBhCYkWbd47oHvM3t9QakMklFsXowVe/M8OKnj98hsydyeW4nmfTlHE0lDhsv7c7FznyfDw6xTwVz0y42NxpMbyCWBo9DFRbiB2cCnd+FaYHUVF3FuMrvDbHiBJF68QA3zNL4icmtzMqYzWNwaMFAqR8HDZ3O2WfiOnIkRGyEDvV7Hr/DUgrQpG4mNY0WlsgcqKL4a556oPG22aIugzcVdAFqoDNUgiZsN0n2WaeDZX8TH5 X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 14 Jul 2026 20:55:35.0902 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: e803bc18-caa9-45e1-ca0e-08dee1ea4064 X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.118.232];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: CY4PEPF0000FCBE.namprd03.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: DS5PPF016FC81DF Content-Type: text/plain; charset="utf-8" tegra241_vintf_init_vsid() programs the guest-provided vSID into SID_MATCH, whose VIRT_SID field spans bits [20:1] with bit 0 as the match-enable flag. The HW therefore matches only a 20-bit Stream ID. The bound check rejects only virt_sid > UINT_MAX, which admits a value far wider than the field. The write "virt_sid << 1 | 0x1" then drops every bit above 20: a virt_sid of 0x80000000 lands as SID_MATCH =3D 0x1, a valid match on vSID 0, so the entry aliases the wrong Stream ID. Because vdev->virt_id is guest-controlled, a VMM can trigger it. Validate virt_sid against the field width with FIELD_MAX(), and program the register with FIELD_PREP() so the value and the field stay consistent. Fixes: 4dc0d12474f9 ("iommu/tegra241-cmdqv: Add user-space use support") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Nicolin Chen --- drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c b/drivers/iommu= /arm/arm-smmu-v3/tegra241-cmdqv.c index fbf7ecf043a8c..812cc500b4a1e 100644 --- a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c +++ b/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c @@ -56,6 +56,8 @@ #define VINTF_ENABLED BIT(0) =20 #define TEGRA241_VINTF_SID_MATCH(s) (0x0040 + 0x4*(s)) +#define VINTF_SID_MATCH_VIRT_SID GENMASK(20, 1) +#define VINTF_SID_MATCH_ENABLE BIT(0) #define TEGRA241_VINTF_SID_REPLACE(s) (0x0080 + 0x4*(s)) =20 #define TEGRA241_VINTF_LVCMDQ_ERR_MAP_64(m) \ @@ -1244,7 +1246,7 @@ static int tegra241_vintf_init_vsid(struct iommufd_vd= evice *vdev) u64 virt_sid =3D vdev->virt_id; int sidx; =20 - if (virt_sid > UINT_MAX) + if (virt_sid > FIELD_MAX(VINTF_SID_MATCH_VIRT_SID)) return -EINVAL; =20 WARN_ON_ONCE(master->num_streams !=3D 1); @@ -1256,7 +1258,9 @@ static int tegra241_vintf_init_vsid(struct iommufd_vd= evice *vdev) return sidx; =20 writel(stream->id, REG_VINTF(vintf, SID_REPLACE(sidx))); - writel(virt_sid << 1 | 0x1, REG_VINTF(vintf, SID_MATCH(sidx))); + writel(FIELD_PREP(VINTF_SID_MATCH_VIRT_SID, virt_sid) | + VINTF_SID_MATCH_ENABLE, + REG_VINTF(vintf, SID_MATCH(sidx))); dev_dbg(vintf->cmdqv->dev, "VINTF%u: allocated SID_REPLACE%d for pSID=3D%x, vSID=3D%x\n", vintf->idx, sidx, stream->id, (u32)virt_sid); --=20 2.43.0 From nobody Sat Jul 25 18:53:13 2026 Received: from CY7PR03CU001.outbound.protection.outlook.com (mail-westcentralusazon11010052.outbound.protection.outlook.com [40.93.198.52]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0B926429CD0; Tue, 14 Jul 2026 20:55:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=40.93.198.52 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784062556; cv=fail; b=OGtUgDjRUCc2M5Jev+JQRTDWdCyIWm7LdVJ7xnFBGc4uQ+/xxmdIiqu6L+VdvI5ewiLLbpDceE2JUTjEQVzej1UM2xvjK8RhOl4Z8jZnrNjzPqnewNkcFu0xi+9KBZB7oCMXq0RYSCGzsL+T5gIY+LhJv+gRC9RekwhBBIs2UQw= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784062556; c=relaxed/simple; bh=PdtmrloiLyRf0K/mT2YIwur7T6STNA725iaBsEkqS28=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=QvC3hlOxacM3pK8h2CVwR/K7dRh4FEBEhF1zRD17HCAqww7ubuUqqxB5enFD39Pi+dpfCRAWpOeVpLM0t0XDig/jyxvRNm9CHGTmTVS3xlRLTHBs5BlbzB7g8yscHatWD1lVwnjvlWDnjd8JRW3vgAgv8JTLIfe4M9cczP4PsPg= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=l06R8noI; arc=fail smtp.client-ip=40.93.198.52 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="l06R8noI" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=y+WiE4WiBf9dlOW78PQ5z5PyTsILQurgUw78fo7LKlkSm17Lzxygk1pk45uZ7OE1gV+8UKocyzyMAeXObYZMX6fZedF7li8js1zgg65ErnGtExGbCC1FOX2tMHlOC+U+ZR+hMrJknu+HAhcceOD2y42T+GR/sr+pw7cBHpZugna2EvrbMBljYHVMQMNsm5elj0yEazylX5kNhoiqU0j8wjsFiIN8mRLSRkQh77dkiqIvNFztgCCY3Qmh+BmqYzx5FxqkTiTZrHPvMJXAPB0ZFLrIl/Atm1oeT1611bvLy1Y2b2rPBw7lED4SUl19eQSuMSqankbVziOZHLx5ryh7lQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=oQmuNW4CUqpnF8uEiYI7/H1+O1lG4iW0td8Y+cgWhzE=; b=VFFBZ8qJI8duQ7Ns1tJdahd4I1MBorb/EKF9iGhNVclOCMpTIRZdh551xIUvEQcjP6ZavLf+yNrSYbEz/6+mUAQPG3I66r1ruhPobfSXUN4uMTVcfaMLLOPH2quHlKwpeahyqY56Mfk07hDDxLP2fSlHLcDMIkZfZ/SDkvyxSgZYjqC8vmY5v68BA3uaNVBZHglIgZ1bsnJxdjS8E55vtd556eLbCpm1JPVaZDmZXo+LHX4tvBCKB+XVw+VvRethqDYWijWUG/9kbrYlySOKB4kee3L9yLszrv7punQtCHEkpQtNaU3Oo/n4kFHAdQ+PzZefefmlL1iC43oeMCIXFQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.118.232) smtp.rcpttodomain=kernel.org smtp.mailfrom=nvidia.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=oQmuNW4CUqpnF8uEiYI7/H1+O1lG4iW0td8Y+cgWhzE=; b=l06R8noIY/2QOLaBo+aRCg62gcV5lQ1AMcNDi4p4YyBhcK3QusW2hz8pze95v1AkgnG7dXNTrMRZhCEB85SvZLLfWkySx1oHTvAlnlB8WF8EmmFzT8JjB86eEgNv8VOT58nZ6mVEfPnQ3x/jJWy08eGGyiVKB+1PPqsRHeZEBfBcZ9BZGHJ3WtaTQxZY37IsFX5OpIqeEga3j2XXr4dpSzWcOp/fVYe5e+TZutEamCFCZ045R0uzpfxMqwmDPWKh5GretLUUGvIPtGcI+IM9kcysjkSqsYKumv+L6k1OL5xi2r2dECQ+aoy0CdTw712Qqj+PHzbVJJ5SQAIUQYViFw== Received: from SA0PR11CA0089.namprd11.prod.outlook.com (2603:10b6:806:d2::34) by IA0PPFC855560D7.namprd12.prod.outlook.com (2603:10b6:20f:fc04::be4) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.202.19; Tue, 14 Jul 2026 20:55:38 +0000 Received: from SA2PEPF00003AEB.namprd02.prod.outlook.com (2603:10b6:806:d2:cafe::58) by SA0PR11CA0089.outlook.office365.com (2603:10b6:806:d2::34) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.223.9 via Frontend Transport; Tue, 14 Jul 2026 20:55:37 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.118.232) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.118.232 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.118.232; helo=mail.nvidia.com; pr=C Received: from mail.nvidia.com (216.228.118.232) by SA2PEPF00003AEB.mail.protection.outlook.com (10.167.248.11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.223.9 via Frontend Transport; Tue, 14 Jul 2026 20:55:37 +0000 Received: from drhqmail201.nvidia.com (10.126.190.180) by mail.nvidia.com (10.127.129.5) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.43; Tue, 14 Jul 2026 13:55:17 -0700 Received: from drhqmail201.nvidia.com (10.126.190.180) by drhqmail201.nvidia.com (10.126.190.180) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20; Tue, 14 Jul 2026 13:55:16 -0700 Received: from Asurada-Nvidia.nvidia.com (10.127.8.11) by mail.nvidia.com (10.126.190.180) with Microsoft SMTP Server id 15.2.2562.20 via Frontend Transport; Tue, 14 Jul 2026 13:55:16 -0700 From: Nicolin Chen To: Will Deacon CC: Robin Murphy , "Joerg Roedel (AMD)" , Jason Gunthorpe , , , , Subject: [PATCH v2 08/11] iommu/tegra241-cmdqv: Require exactly one Stream ID for a vSID Date: Tue, 14 Jul 2026 13:55:05 -0700 Message-ID: X-Mailer: git-send-email 2.43.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-NV-OnPremToCloud: ExternallySecured X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: SA2PEPF00003AEB:EE_|IA0PPFC855560D7:EE_ X-MS-Office365-Filtering-Correlation-Id: ba85819b-fa6d-462b-7996-08dee1ea41c3 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|376014|23010399003|82310400026|36860700016|1800799024|11063799006|56012099006|18002099003|22082099003; X-Microsoft-Antispam-Message-Info: TEpQXEyBomDBuFs8Uky6Y+XXdT2DWTWpZ/1aLkDCRdx7XivXdSqTDfqJuBnROhZ07lhWVM7PUq6rVMNKyVVqtlxaj4aApDR/T0K0K9r0FaKvU3AI/Lqf1/bp5URrI2Xm91h11gj8/lKdK5W09+4Yuw9sAXIdEXONOP6MEHeyJCUoSK0LHnopBd6pj3koHatf/Q1monNkJhQKyZHbxPZlbirUx9uEfDRNUZevQG4+IooleGivLC6SE2HnZSlsvPp9v92iM5Ygarto2bI8Yz7aPiLUaViowPGBehDhr+itIkRPaNrg44CB9DR+M6HVz3SZaJLiYF/WoKGKwC3yCtjR4WBm1C9sOnc4hsSW4L87YJrtZVplkwp4srrOVOqgyvqlBAmK7Fve3fDJbQeyByfcPisalQUoCybaLrKX4q0Mrc37DPunZKS2PWfC6QrKeDZJJY6XEX3oGdB3FuojchBX5jDQzX1pdHwoqeq30Hkby/5Wqmiyc/s1oJNp2TN1eNOlPAymkXULRClnOZvz9Fc4fdme/WkK6GLX8C74MSE4uvvOtYaYPC6akqvuBuzhd7hldpNOHtrtFZ7YkEglOvB+i0d5HeF4j6NfDg5jIWPzQYEBU8G0lLDn9z21U2lhojpaFCvDOmIGdwKkmEN643YfEUC4ANOY/0A7eWWsWzDyPSc9kDRNa5QVKyYW+o4XWv4KcIBVOm3Xaj4fMch3ymykJA== X-Forefront-Antispam-Report: CIP:216.228.118.232;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:dc7edge1.nvidia.com;CAT:NONE;SFS:(13230040)(376014)(23010399003)(82310400026)(36860700016)(1800799024)(11063799006)(56012099006)(18002099003)(22082099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: 8fYELi/H7W3Gej2iFrmn9mxjPyqc5VAVjmAE0iVLxY68zG6FSy22DGyFwMPF5ijUHhtNyaSKy8YgSv53ubkvVYYHTObqo1tpr9dN6Nly3axiE+mOix5E8QKQK9VZEx2Wqio3NZEt8YneNCb32tYFs6mdMojxVISB9xojvLDwhsMcbB3if7UXs/Ho/3hirVVPmbBAkUCJyOkKfyAXX4l2kQFh9GqVYY8GSlADrnJYQEP9wF+82S5xzt5QV4bjEqb/S69Vt1hIB76LRtNn+oHyD9yCL1zvdxyIqWGmaseV/YuZQz3QuaAqdjSdSdEFd9wabh+bTvXJXwthnyH287wD4GUQ/FEG/zjFGhVCodsnrcw4cwrzTHrIeelocotWfxCLuEB2rLKn+IWQyqXTXbGCitVwsXAb0F51yFrvcVqMR2EQkFNXZqezxvm59Fwqumr7 X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 14 Jul 2026 20:55:37.3867 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: ba85819b-fa6d-462b-7996-08dee1ea41c3 X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.118.232];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: SA2PEPF00003AEB.namprd02.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: IA0PPFC855560D7 Content-Type: text/plain; charset="utf-8" tegra241_vintf_init_vsid() maps a guest vSID to a single physical Stream ID taken from master->streams[0], and only warns when the device does not have exactly one stream. A device with several streams gets only its first one mapped, so a guest vSID invalidation cannot reach the others' ATC and IOTLB entries; a device with none makes master->streams a ZERO_SIZE_PTR, read out of bounds. Reject the mapping with -EOPNOTSUPP if master->num_streams is not one. Fixes: 4dc0d12474f9 ("iommu/tegra241-cmdqv: Add user-space use support") Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Nicolin Chen --- drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c b/drivers/iommu= /arm/arm-smmu-v3/tegra241-cmdqv.c index 812cc500b4a1e..e3603cddde018 100644 --- a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c +++ b/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c @@ -1249,7 +1249,8 @@ static int tegra241_vintf_init_vsid(struct iommufd_vd= evice *vdev) if (virt_sid > FIELD_MAX(VINTF_SID_MATCH_VIRT_SID)) return -EINVAL; =20 - WARN_ON_ONCE(master->num_streams !=3D 1); + if (master->num_streams !=3D 1) + return -EOPNOTSUPP; =20 /* Find an empty pair of SID_REPLACE and SID_MATCH */ sidx =3D ida_alloc_max(&vintf->sids, vintf->cmdqv->num_sids_per_vintf - 1, --=20 2.43.0 From nobody Sat Jul 25 18:53:13 2026 Received: from CY3PR05CU001.outbound.protection.outlook.com (mail-westcentralusazon11013011.outbound.protection.outlook.com [40.93.201.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AC0B4427FB4; Tue, 14 Jul 2026 20:55:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=40.93.201.11 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784062556; cv=fail; b=Yrp898YOjdSflwVsOIvMduUKWiCvPkpntzbDxADH5u6TitmTSKLINf7EhgiT0dSg8ES5JGK1rc3PzBp5mYohcyoOvijoN7MITQbYMC8ST0jLkX9mJwK8aqzIumGSWuowNVZDjOD4FgYX2TokznjVmK3IbYnr9a3JJ/+8sEZK1EE= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784062556; c=relaxed/simple; bh=3EWczJn6APdVGMo6veELuHBfEX7rY5vFFCnjMmyTOB8=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=K5hwIL80uXtK+wLAx86K8WzUX4+9LHPhD9p28A7myMYOEp7lhjL3qrI6BIivBR/YvPamIOXfFoYxhlbH7cdkckmK1StaS+xddMVr5DDUkVQL6Zazunn1Yomk18Uj/ts5y/WgsQ2yL5EUrAjqRTW2hrdEL46J/Fti5jjTHeLluVo= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=hTegwg6Y; arc=fail smtp.client-ip=40.93.201.11 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="hTegwg6Y" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=DkO0Z2WQ9ByYiyrAoSPOOCcAXn/UNNF3nHXSAGr3ts3FifEXURq6/as0zztFSdupr9/H1tJ+da18C/SIv+Ux3oLcAJ/tjHP7+8rPZWJZoAYedwwdKnN84mpDY4JljPk8f9dyjKWCxk8p+8U4aU2u7vEWvv3B/yfxFNwtGXFbIYvK0xS8kD7xv7x49ocVNLoIqI8wfIzlPmPIUhLUZMmCkwrkOr9gzYZ5uFsd3w0XAB9bJ50oWdrS+2DO4DNaP3MfFF6MvHzX0ZikHkghcDbY9fwwlPtPJFmfhCEGvJPsJW2dHPZyyvlrBqWhc5/nyVOo542MKCbY7Dd5lhjC+ah9XQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=5LMyykbbC/WWTAzTJx4YWBzZjQUYfslw/7D0TRjuwUM=; b=r+eCBaRkqpxN76f6jIcWc2X6YWOqVjYcf4o/J0uxJ4BjhMaqvtzYmKS7a+ADM6J0ar41RUnhSarzt1JKjFrixeFtvD3Tg0YtEz8Ub19wHs9N79rpTy32zO4C4eqeqXbcFjLJ9+EJbHSQ32iMgUI++bYgm710qZpWyxJspflmiajG8xWwlQXSp3Gma6hW1RdvZ5fRuCsvp7A8XI9GKOafKArdadi27nMZqSD8PXSCz4PnsG2PQi31HsOIwyz61fngRiu3JJH1D8FJwY4cML7qy++ubpN3p1vTiHb4dkfylrhN86OSce/+qKrRBy81h8KO8bJ3XF/991d+iWwELZWsIA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.118.233) smtp.rcpttodomain=kernel.org smtp.mailfrom=nvidia.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=5LMyykbbC/WWTAzTJx4YWBzZjQUYfslw/7D0TRjuwUM=; b=hTegwg6YT8qOo7kg200/Cv0AjG5McfXVe5m3YVODGlX4PBMuhf2fAkZA9pOb7mZSCI2NlORoVIizj7LIS55zeWT3cMggUACUgDw0wrjqalzGX+R1zAL8D6BzWz5EYj9X6uDTpVycV50tYCoG6TmY3RJWTdo6vQb5sK8k3Vf6fowyssOiJiWkTCPAVx6O/JPeV7UYc/DNo/tvolzd8faPAj4BcF5gwWvXMsr/prIpKFDJWPW9SGvYlVEz09+JpGEcWzpY6ZTj0nv9qg03Hw0PW4a08j7n8VcaAl5KgBi26AjW2sQQnNgGebGGRrNVJz2x9LknQ8owqCLUnn9KHirF8g== Received: from BN0PR04CA0111.namprd04.prod.outlook.com (2603:10b6:408:ec::26) by MN0PR12MB6224.namprd12.prod.outlook.com (2603:10b6:208:3c0::21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.223.10; Tue, 14 Jul 2026 20:55:41 +0000 Received: from BL02EPF0001A0FA.namprd03.prod.outlook.com (2603:10b6:408:ec:cafe::49) by BN0PR04CA0111.outlook.office365.com (2603:10b6:408:ec::26) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.223.10 via Frontend Transport; Tue, 14 Jul 2026 20:55:41 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.118.233) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.118.233 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.118.233; helo=mail.nvidia.com; pr=C Received: from mail.nvidia.com (216.228.118.233) by BL02EPF0001A0FA.mail.protection.outlook.com (10.167.242.101) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.223.9 via Frontend Transport; Tue, 14 Jul 2026 20:55:41 +0000 Received: from drhqmail201.nvidia.com (10.126.190.180) by mail.nvidia.com (10.127.129.6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20; Tue, 14 Jul 2026 13:55:17 -0700 Received: from drhqmail201.nvidia.com (10.126.190.180) by drhqmail201.nvidia.com (10.126.190.180) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20; Tue, 14 Jul 2026 13:55:17 -0700 Received: from Asurada-Nvidia.nvidia.com (10.127.8.11) by mail.nvidia.com (10.126.190.180) with Microsoft SMTP Server id 15.2.2562.20 via Frontend Transport; Tue, 14 Jul 2026 13:55:17 -0700 From: Nicolin Chen To: Will Deacon CC: Robin Murphy , "Joerg Roedel (AMD)" , Jason Gunthorpe , , , , Subject: [PATCH v2 09/11] iommu/tegra241-cmdqv: Fix VINTF0 leak on the init-failure path Date: Tue, 14 Jul 2026 13:55:06 -0700 Message-ID: <894f84ecc005f2a873491ca6a11ada17f40a45b1.1784059577.git.nicolinc@nvidia.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-NV-OnPremToCloud: ExternallySecured X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: BL02EPF0001A0FA:EE_|MN0PR12MB6224:EE_ X-MS-Office365-Filtering-Correlation-Id: 07f1d849-81a7-428b-07ff-08dee1ea441b X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|36860700016|1800799024|82310400026|376014|23010399003|11063799006|56012099006|18002099003|22082099003; X-Microsoft-Antispam-Message-Info: vQy0JoZUHRZ+Grrx9h8nVSIIaXFiKCSe1n33iKBteERY3llxwaN6/DJFHQ2CVSO48FBD/kXbaRC2XPkxCxyTkc+F3cBjmXBIanEy0SQUox337obPuPL8gDJFWObUh1N/JwBxEe94/FGvBRrQtr1ig+nAnyxS1laGfAeLX4ee0OV0x/dEP7GhoxBRNtMrRdatVReL2T5L/naNuK97nWHYcu6e0TGOlCM7LtCm2cRZuHf7z3GNrDtYtSKU0+DyqVHxWccRIoCZt28uLCP9+4N7f5g/3aK2DtFabEnPXzOejwQ1PWuiJObrI3Jw6qF2TOddvkMd79tkWYSsHdAo23CKcosAeKyAXLNjEnz6bCB0PnIF3ymHi2rnKhp7hNJsOtUX21VJYquXQk6HmnYhCyY1Y37jEJDPMOB49gzC1Xj37uAjVzOKNyxqj4i7qa4yq86pkRc/LPfcGiRIgGw3Nwsi/vYjgf9UI8RUxE1CUNBUgesNCTBsPWwkG5S2Idt0vu4BjFDB+FNmN9tAUo9GqYjaZhMIO08aUUBBxAeRwh1KYnb5eKze4NouE6A1ey1by9NdJQRAN/vUYHIWRGUeU1El8V+w+Rw6W4rYzRHFzeU3M7LO9NGnKpCka1IMGAArSFNTH7Bhekkcs3kqaNanYJ7KjO08j3SVIWqUgvR3l0TDrJaQ1qnfSS7VIaSGTmcLfcH0dC9b3fgtNX5DPjz7df3lAQ== X-Forefront-Antispam-Report: CIP:216.228.118.233;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:dc7edge2.nvidia.com;CAT:NONE;SFS:(13230040)(36860700016)(1800799024)(82310400026)(376014)(23010399003)(11063799006)(56012099006)(18002099003)(22082099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: xzJ+oaSxGr6gOpvQYMFk7vRmsF8FOD8m+DOGSsBOyQVhWDnhgKfmqJepTCux/2bbH0Id/idGUF41YF0TxtlyXbKHgLIlvTVsiWNOA7sLnS/FB4dT9+a9YQamOJDQT8CKF/LPljn1rKSwSGSgGcvMy2tPM6qzU2RCoq168nL7+cmUBRk+qg+Gs/Er7e/Dr1GPBl3Hn13fZ3kDgI4WvRsEf0itdOnGtymfoVgbvdSRsgMPazAy12P/LYM6RwTcCrrBgJYU14q4Yry6wZ+Wtzzs9Of/mnvREWlgsfrcVjFZFHz9q4fFrAuygl9OS7qtRcix8UlxTcxayAFYQO6fLbG1IcAbFny4mVxucHXuZfaKB/pkasGYM3BY+6jMxrGUwWbV0cwE0xXcO7OeQZQaVSH2mdCZAlIUmaYHirekZ/FaUsP8LrvpwhfTRFFN4b/wtVQm X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 14 Jul 2026 20:55:41.2609 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 07f1d849-81a7-428b-07ff-08dee1ea441b X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.118.233];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: BL02EPF0001A0FA.namprd03.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: MN0PR12MB6224 Content-Type: text/plain; charset="utf-8" tegra241_cmdqv_init_structures() allocates VINTF0 with kzalloc_obj(), inits it, and preallocates its logical VCMDQs. Two of its error paths leak. When tegra241_cmdqv_init_vintf() fails it returns before VINTF0 reaches the cmdqv->vintfs[] array, so the devres unwind on probe failure cannot reach it; free it directly there. A later VCMDQ preallocation failure instead leaves VINTF0 published, and so this time the unwind does reach tegra241_cmdqv_remove_vintf(), which then frees it from vintf->hyp_own. But tegra241_vintf_hw_init() sets that flag only afterward, from a HW read-back, so the still-uninited VINTF0 reads as guest-owned and leaks, with mutex_destroy() and ida_destroy() run on fields it never set up. Decide ownership from vintf->idx instead, the index assigned when its id is allocated: idx 0 is the kernel-owned VINTF0, while idx >=3D 1 marks a guest VINTF. So the in-kernel free decision in tegra241_cmdqv_remove_vintf() and tegra241_vintf_free_lvcmdq() now keys on idx too, and hyp_own stays a pure HW-readback state. Fixes: 918eb5c856f6 ("iommu/arm-smmu-v3: Add in-kernel support for NVIDIA T= egra241 (Grace) CMDQV") Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Nicolin Chen --- drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c b/drivers/iommu= /arm/arm-smmu-v3/tegra241-cmdqv.c index e3603cddde018..f93e59b7bd2db 100644 --- a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c +++ b/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c @@ -716,7 +716,7 @@ static void tegra241_vintf_free_lvcmdq(struct tegra241_= vintf *vintf, u16 lidx) dev_dbg(vintf->cmdqv->dev, "%sdeallocated\n", lvcmdq_error_header(vcmdq, header, 64)); /* Guest-owned VCMDQ is free-ed with hw_queue by iommufd core */ - if (vcmdq->vintf->hyp_own) + if (!vcmdq->vintf->idx) kfree(vcmdq); } =20 @@ -816,7 +816,7 @@ static void tegra241_cmdqv_remove_vintf(struct tegra241= _cmdqv *cmdqv, u16 idx) =20 dev_dbg(cmdqv->dev, "VINTF%u: deallocated\n", vintf->idx); tegra241_cmdqv_deinit_vintf(cmdqv, idx); - if (!vintf->hyp_own) { + if (vintf->idx) { mutex_destroy(&vintf->lvcmdq_mutex); ida_destroy(&vintf->sids); /* Guest-owned VINTF is free-ed with viommu by iommufd core */ @@ -921,6 +921,12 @@ static int tegra241_cmdqv_init_structures(struct arm_s= mmu_device *smmu) ret =3D tegra241_cmdqv_init_vintf(cmdqv, 0, vintf); if (ret) { dev_err(cmdqv->dev, "failed to init vintf0: %d\n", ret); + /* + * tegra241_cmdqv_init_vintf() failed to publish the vintf0 to + * cmdqv->vintfs[], so the probe unwind path that goes through + * cmdqv->vintfs[] would miss it. Free it here. + */ + kfree(vintf); return ret; } =20 --=20 2.43.0 From nobody Sat Jul 25 18:53:13 2026 Received: from BN8PR05CU002.outbound.protection.outlook.com (mail-eastus2azon11011029.outbound.protection.outlook.com [52.101.57.29]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 84E40429CD4; Tue, 14 Jul 2026 20:55:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=52.101.57.29 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784062554; cv=fail; b=GlGd57b8+45x6VtqQuBWza5NjOVXWVtYE8y8x0hMhOsSI9YwHSDf5XiIdCKInM+eGnYBvhTovIyh1n64TfQqFOwK6+9HMUAGja7U2VQeIe7hJq9DfuWivWDfTnhoh+9pttOtfiKw4cTZn50Jw55ZhbJ6iqzDWVdrEGvjAVtxBIE= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784062554; c=relaxed/simple; bh=Hi6SWJjGUFRRO0hRHHvlUzX6XMUsJ/J9xAohY1G9XpE=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=DYgy1nhTCKwc2wTQn8c0Z0qa0JPJ0/KULxcfQntnN967zlLsRAR7BAIvdj7wRuT0PxDQXZnSZj0LBYkDGbwTfaKBlwzGUrHBlOtjP0CbmU4n4CflZgaQQJUYqac2oHin2a4c3l1SuiSrGeeRVq5gclYRzSYiwC0hdvafHuRPfgk= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=navIxXMe; arc=fail smtp.client-ip=52.101.57.29 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="navIxXMe" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=c7Z4f4QP+6zkt2oxdue8Oebnu7OMJwhdPpC21BNRNKXYgGYQ3HfV9IpUgoMK3efFGvE1U7q4fvyxDOL+yE+XuwzHI+Nm6jMlbZD5uKJIrRq9IFe2METXIAGZoxjuurpvev//iocMiOcqcST4H59ZibluBGomS3vxTkCDei7d6IFg/rikbq+X+GhX9I7H14bHTIpnTEqbCRUTU5adIgoe0osx+WCBgBj+ntg8kDxTON55LGkTR6A9KB8N0SXNLffxf/Y2uLhUDvPrhBrnMPy1qkwrwl1+N9WnKh8z26ZThpB5EpRvWkgFfv6ShpOJ1WjXxXtadcGqTKkMY/Jhpmte0w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=cNoQcNX/8h2HXIdZoQdMkHS3nWMo1hP+4h9R040dKBo=; b=yjL13nGs+SYzM8hhUsz3ImU8i/8B5nqU0mYXPjTJWeP1zZ4SuwJlLPmbI3m7pOQBehJytKLmRFVfllFhlXbF7W15AjTnloQrC4ulZgySGoxwFwlrncOSj/WzVBVX+qdZdygk9N+dlaiSMVCLFbPIgE+W1LD1cEvN44Wq3IMVrbVkGU7qFI3GfupHiiSehedZnAPPJGc82mx2/L4cLz8Nr/nA21e4EuimyhEBILb3Yl2cqcNUqIjHiILc5NWWbLBt6LQqVYyOjt45IJ6sf90po1kMqzOQJry/MsqARG7lKf3WPtCm8OCsilG16PQ+XsGGSQrpa3nHgW+ej20dJnym0g== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.118.233) smtp.rcpttodomain=kernel.org smtp.mailfrom=nvidia.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=cNoQcNX/8h2HXIdZoQdMkHS3nWMo1hP+4h9R040dKBo=; b=navIxXMe2Zage1qWtK53l8IfMcxWPE3MYJgXtmf2n9nEbnW7wAKxZnbNrlRuN7HAHwYVtOYXkpRLPWAoFP/MEWbGx8OIpnV/pffpiB2SckCqRhABAWg4WzaCuPJ/gfdaP9DzCpH7v+afw2ub2F+qbax0GVz8wYP23PbQHFIORsO9TxFlzYVUJzFtF+fzNOaesOZNFhhefcIjK+UC46Senr7y1qkDqsicjDN1F9hHG5WQ1vIT+Qpxs98JeyzWeYIkJyTQqIOK5yCVrUgEptsA6GXkC2xkocZb1BZYZZ+q/V9Rc87thjYY21Nv74UzaeIY0u+sFt94qmMCwMIy/nvoNQ== Received: from BL1PR13CA0123.namprd13.prod.outlook.com (2603:10b6:208:2bb::8) by SA3PR12MB9130.namprd12.prod.outlook.com (2603:10b6:806:37f::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.202.18; Tue, 14 Jul 2026 20:55:42 +0000 Received: from BL02EPF0001A0F9.namprd03.prod.outlook.com (2603:10b6:208:2bb:cafe::ad) by BL1PR13CA0123.outlook.office365.com (2603:10b6:208:2bb::8) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.223.9 via Frontend Transport; Tue, 14 Jul 2026 20:55:42 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.118.233) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.118.233 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.118.233; helo=mail.nvidia.com; pr=C Received: from mail.nvidia.com (216.228.118.233) by BL02EPF0001A0F9.mail.protection.outlook.com (10.167.242.100) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.223.9 via Frontend Transport; Tue, 14 Jul 2026 20:55:42 +0000 Received: from drhqmail201.nvidia.com (10.126.190.180) by mail.nvidia.com (10.127.129.6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20; Tue, 14 Jul 2026 13:55:18 -0700 Received: from drhqmail201.nvidia.com (10.126.190.180) by drhqmail201.nvidia.com (10.126.190.180) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20; Tue, 14 Jul 2026 13:55:18 -0700 Received: from Asurada-Nvidia.nvidia.com (10.127.8.11) by mail.nvidia.com (10.126.190.180) with Microsoft SMTP Server id 15.2.2562.20 via Frontend Transport; Tue, 14 Jul 2026 13:55:17 -0700 From: Nicolin Chen To: Will Deacon CC: Robin Murphy , "Joerg Roedel (AMD)" , Jason Gunthorpe , , , , Subject: [PATCH v2 10/11] iommu/tegra241-cmdqv: Warn on a VCMDQ base above the 48-bit hardware limit Date: Tue, 14 Jul 2026 13:55:07 -0700 Message-ID: <4e638ec1bbff46a358b4129e264fef66b4f37703.1784059577.git.nicolinc@nvidia.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-NV-OnPremToCloud: ExternallySecured X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: BL02EPF0001A0F9:EE_|SA3PR12MB9130:EE_ X-MS-Office365-Filtering-Correlation-Id: 271238e3-27c0-4866-98ad-08dee1ea4490 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|82310400026|23010399003|1800799024|376014|36860700016|3023799007|11063799006|56012099006|22082099003|18002099003; X-Microsoft-Antispam-Message-Info: tJjNabNjscSLpvYQCa3nrMi6CVWxgbR6T0FMvHfx5MuD/y4J3zSqfVEaFcb02/tHGstBZ693qaahg2bU7mlalC/ITiCsd6DEP9OIBi+uO49XA/VEv55VxjZnqKKOYbuBqp0AVwVRfb9jCSEkDU+8duu+QCJTM0zPFub6j/HTcWuuSX/6FlYHovQyvh69jyG/OqIFjRc2nQGgqjeJIQUrVgd5NcUXU0HNWQm4kjgyZkQ+enGfi4h8hgz4sCMlt0I0KOkDUEPmYbWTEoh/GmBnY0m/n1d4QWl2/kQ2CdwOfEKZUelb5KD/+sJ7u2gCA2E/KUBIO+OKNY3xcVb1RxP+TGXzNExbYpV7wCgdvcDu51HGQhne6CUke7ifB6t7sZ9G7ek4w+WbS1uIeL1/9uDXVXR69dytl98LyiFBaqlCErKt0neJrHhTKxpG3LhYG8b1jOngWqlaykYTZWletvosSCiIq7pHyiC4n5gV09hAaBNfK+mrdr7atOuMUzIEkF7EWSrIKd3Nqv3Xmyl7BLN3Zk+VJjM0LVHv/xFgr1E6DCt19T3pqS3GC3PiCe30W9XgOlEmmDYMxTsORhhQ6+ZxxViNaUvictUtslkgGpbWctX+hTbo9q53kezJ6nBPucUMCJq6bX2Or7HOgogekpAeXZkXxZ1NK4rE1C9u/CD+tqy5zFzl+SL3xl2GR7LQecu+ X-Forefront-Antispam-Report: CIP:216.228.118.233;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:dc7edge2.nvidia.com;CAT:NONE;SFS:(13230040)(82310400026)(23010399003)(1800799024)(376014)(36860700016)(3023799007)(11063799006)(56012099006)(22082099003)(18002099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: 6GnS7NNPsOsaw/IRajWDpTyk7z7Xiw0ya/WHS0MrECARnEmjJl+hSKrAZRF/gIVm/BbSc5TLx92R51mixuqJb+j26Cx/8so8G/XbPIjJ88Q9Q35RdOxsOkml30/HgHKpKhIbLXc4vaPAbYPwZl2n8knz27LcwbLyYveXty17b8c5VOu2wqsopPmAXpXEvUX7t7kIkrqIbJA8bXOxEJJ4rWvzcs+INbI0q6/Sg6wZ6zOsg3MVr6o0lzqraURiRKimsYIPbOoH0ubPizORcbYDq34aqMypjBsDaCTorXHOMkdP2nWOYXx37yVtehY1tXmx8YAIIgee0O7cQ5reQVgaeINFgEBWfLZtReNlHf2HW0bR+sRr1iTFiWydsFnL2OK6ItnWSPHTGQbhp2SNQwQ8tDcxat82LlsXFyA9nO4OFp1oKFmUQ6IP2wnMulOdSVnE X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 14 Jul 2026 20:55:42.0203 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 271238e3-27c0-4866-98ad-08dee1ea4490 X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.118.233];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: BL02EPF0001A0F9.namprd03.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA3PR12MB9130 Content-Type: text/plain; charset="utf-8" tegra241_vcmdq_alloc_smmu_cmdq() allocates the VCMDQ buffer via the common arm_smmu_init_one_queue(), which uses smmu->dev and its coherent DMA mask of DMA_BIT_MASK(smmu->oas). The architectural Q_BASE_ADDR_MASK is 52 bits, but the Tegra241 VCMDQ_BASE holds only 48 (VCMDQ_ADDR), so the masked write "q_base =3D base_dma & VCMDQ_ADDR" silently drops bits 48 and up. A real Tegra241 never reports a 52-bit OAS alongside the 48-bit VCMDQ, so this cannot happen on correct hardware, but a buggy or hostile hypervisor could still advertise such an OAS to a guest. The user-VCMDQ path already rejects a base_addr_pa with bits set outside VCMDQ_ADDR; add the same guard to the kernel-allocated path, failing the queue init rather than silently truncating the base. Use dev_warn_once() rather than WARN_ON(): the OAS is hypervisor-controlled, and a WARN_ON() would let it panic a guest that is booted with panic_on_warn. Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Nicolin Chen --- drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c b/drivers/iommu= /arm/arm-smmu-v3/tegra241-cmdqv.c index f93e59b7bd2db..d27ee215032f7 100644 --- a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c +++ b/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c @@ -674,6 +674,19 @@ static int tegra241_vcmdq_alloc_smmu_cmdq(struct tegra= 241_vcmdq *vcmdq) if (ret) return ret; =20 + /* + * The q->base_dma is bounded by DMA_BIT_MASK of SMMU's IDR5.OAS. On a + * real hardware, VCMDQ_ADDR mask and IDR5.OAS are always aligned. But + * a buggy VM might set a mismatched IDR5.OAS for SMMU. Spit a warning + * instead of a silent truncation. + */ + if (q->base_dma & ~VCMDQ_ADDR) { + dev_warn_once( + vcmdq->cmdqv->dev, + "VCMDQ base %pad exceeds the 48-bit VCMDQ_ADDR limit\n", + &q->base_dma); + return -EINVAL; + } /* ...override q_base to write VCMDQ_BASE registers */ q->q_base =3D q->base_dma & VCMDQ_ADDR; q->q_base |=3D FIELD_PREP(VCMDQ_LOG2SIZE, q->llq.max_n_shift); --=20 2.43.0 From nobody Sat Jul 25 18:53:13 2026 Received: from PH7PR06CU001.outbound.protection.outlook.com (mail-westus3azon11010013.outbound.protection.outlook.com [52.101.201.13]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 462F5429CC1; Tue, 14 Jul 2026 20:55:49 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=52.101.201.13 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784062555; cv=fail; b=K/0hYpaNqNW9IeXlp5tQF7krGK7KNlUzbcVkVR67adB2hlZoAOlzy3kt38hyH65ZvbheyTDow/CWFlspz4XT/t06AsQKdx0SJ3OscmwxlBwdG1I27ATkfD8gNzmrFPGrcfoPoYKELapGVGEesS6HnJEvNX8tavnNOBZNAEEV5/c= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784062555; c=relaxed/simple; bh=yExzBTt2qPcj80DNM32crk940r4rNuxg0ljWZU5yrAw=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=tuGrsUVmbgk2Xk5rxG9nE1vuMg48dkUNmSnD5OwpVu+Uco/K1FwTB0W9WF3cqYsxgpcECsIeZ+TUiUWOl4WnB/A7uGiMMKEAt+5CCCkndTPjmfE/n5gbT85lmSPUmMCDdq+9xxB+hWE/tTrqdv8zwCr3dfA/tQC1XUCsVb6X4Hg= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=Cl9MNCn8; arc=fail smtp.client-ip=52.101.201.13 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="Cl9MNCn8" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=rIVdruwgK7MjQKfx3BfutRdoZJ0XmGtwfwtRWv5qbhFDQuEcHnunY4tcnb8fegPuuFwkwKpSW662LY1vqhJrPrSxQ6oVm9NzlNht7u/3yhnOnEGC1dlWe1oTUrrXgum+t/LZA/KoqoxFgWJ8te9g+1XvIO3Cs+jYQJyGsZP/sjxrpJVraMBV9DsGllqpgPTDeySuYiBBctwxl8d3MpnsVDJaqTRB3zxl+B51P5jJRBQ9MHLvYYSon5uHi0hrdBHJw9XBDchwU9VWDzggl0ED5A8MCNed0KeftFkAwMd/KIgvzIUlCV5Ilv68zWv92o6RTzPx1i3MDXSZ3XYu9cUAaQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=XmpNk9qGPsz4Qzcw/ZGmi42J4ven8E8cs5INl9cFIKs=; b=qj17MmHyLknTBk6kBjOIWlvhCGXtHlp9AbN4a1VIMLXQxYTNQ21gGtlwi6Qw/pqp9mVCt2SfGy7rbnRABrNyKTCD0CLHHozSp+7OS95lV5Hc/ttpSZkz/RCjnPo4MKtenfeIQLlxIUtnrgMBpuJ400HlAJwjLIQp/ovCY99FcAPVirmhox3qHT87HIZYbWKovE3flLZwIDkKNy2a1mu7uNVEXzqZWghheelx9H6XmHPHBJFp25330AR6m/0B1aZH5fzuRKMObPAsn3KL9EnXmtEeAnzPVZPrQAjN/rXexDoP+5W3I/CvBaOGm6HSlwkFTSJJR7fsHJ0pAyjP51nwyA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.118.232) smtp.rcpttodomain=kernel.org smtp.mailfrom=nvidia.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=XmpNk9qGPsz4Qzcw/ZGmi42J4ven8E8cs5INl9cFIKs=; b=Cl9MNCn8fKwff+480sOHLbM/CQbRWUXLcoQ9uciow50narrORw55Zl8QY2n+OC1XCgAO+3mAXt8OSvdXQB0OhnhjnFTQCXiBMH+V0IHbQqGVpw1HGs7T+qq7+oWF9JVqAcdAJdM3l4dgn7vpoWmtBxOZl8SLMZGxAArPflNUzCcG5FMUvmv6qUVYlixttzGhXryj8Ed5MSodAlhemvmbTwZ2z2MhwfUF8j3gaLiFc9qgwRWYqDlKALnOvd4hoa+VNKjCdulJVJ469b4s1aGc1lvsN/F6TgFVaq/M2nzgVIU+qk3yAFPdUoGmsO0RTfnMg+Jx2c3qE52uTltrE9ywog== Received: from PH7PR17CA0036.namprd17.prod.outlook.com (2603:10b6:510:323::20) by PH8PR12MB7447.namprd12.prod.outlook.com (2603:10b6:510:215::7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.181.23; Tue, 14 Jul 2026 20:55:43 +0000 Received: from CY4PEPF0000FCBE.namprd03.prod.outlook.com (2603:10b6:510:323:cafe::8e) by PH7PR17CA0036.outlook.office365.com (2603:10b6:510:323::20) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.223.10 via Frontend Transport; Tue, 14 Jul 2026 20:55:40 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.118.232) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.118.232 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.118.232; helo=mail.nvidia.com; pr=C Received: from mail.nvidia.com (216.228.118.232) by CY4PEPF0000FCBE.mail.protection.outlook.com (10.167.242.100) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.223.9 via Frontend Transport; Tue, 14 Jul 2026 20:55:40 +0000 Received: from drhqmail201.nvidia.com (10.126.190.180) by mail.nvidia.com (10.127.129.5) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.43; Tue, 14 Jul 2026 13:55:19 -0700 Received: from drhqmail201.nvidia.com (10.126.190.180) by drhqmail201.nvidia.com (10.126.190.180) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20; Tue, 14 Jul 2026 13:55:19 -0700 Received: from Asurada-Nvidia.nvidia.com (10.127.8.11) by mail.nvidia.com (10.126.190.180) with Microsoft SMTP Server id 15.2.2562.20 via Frontend Transport; Tue, 14 Jul 2026 13:55:18 -0700 From: Nicolin Chen To: Will Deacon CC: Robin Murphy , "Joerg Roedel (AMD)" , Jason Gunthorpe , , , , Subject: [PATCH v2 11/11] iommu/tegra241-cmdqv: Rate-limit the error ISR's log message Date: Tue, 14 Jul 2026 13:55:08 -0700 Message-ID: <2e9d088c059037d5fc23532820444720b870d2c7.1784059577.git.nicolinc@nvidia.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-NV-OnPremToCloud: ExternallySecured X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CY4PEPF0000FCBE:EE_|PH8PR12MB7447:EE_ X-MS-Office365-Filtering-Correlation-Id: b79a75eb-52fb-494c-33da-08dee1ea43ad X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|376014|36860700016|23010399003|1800799024|82310400026|56012099006|18002099003|22082099003|11063799006; X-Microsoft-Antispam-Message-Info: l/YjfowV4yTR96luHjRLF+63+OSZr8Jb2k9HgBLY43gMa/zhSD5Mb1lFa2w7eIr9FHlD4bjLikakhR/k7ZgbUlTFcBAJGAXcI+mCuIGhEgsyOwCvZnFjWgayagKnrkiQb+UfsPlzufHC1Jg0gBOmDdzGUAdVjUzVlMaT9EH1CYmv5moAl0NvQLBpcDYAeVSYC9ketoKZc2TCRlnz7w6u4Tq5xy3PCtpYp3pxNvB7SA9Jt38zAzzgu8L8bxXbG7PrXt+l5AJWMm/Ey2HKcLf1I5xWhKnjW8I/Ep86uIzLOm8K5kiFk/O1aWTDY6pBrmiWkvKG3a+tLbTbI1NnBVL/plwh7Z+Yke36bJwfr1hktXKZUo6P8Iq6tG9xjVoo6Eu3ljaqZd0+OcamSx+ZxswJM+ktqRTI1nMAi07NVde3XLvWCeS+QNI2NjXvIkdUmOF3KBcMM2jpcWJFwaCcL5XiqfFhCFoh7Po+0S/VQnoY0EArv5ws65ZQPYdcRJemeAmt09YLCcpfc/bCAXC0AcVRqCQUsUb+86YzXQK++T3nB9gbvYmG8dxYsBD47BFs4HNddgJR1ul3zFO73RfIbt0BS7E5At6ZFuMOI1bq+Pwcx2dlSHhUOihSDBwiBHBnJrUfRse4oH6QSMeb7yXuKNct5tBYMCFkxc8ipafsNBdZZXatjxo9xN/UHo2FMpfi02pj8CCLgh9wbzRLihDsaOsiGg== X-Forefront-Antispam-Report: CIP:216.228.118.232;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:dc7edge1.nvidia.com;CAT:NONE;SFS:(13230040)(376014)(36860700016)(23010399003)(1800799024)(82310400026)(56012099006)(18002099003)(22082099003)(11063799006);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: ZgxprbMR3v7QDSCXf/fb4u0+URPvhKBdxcYo4gcxka3dQ3sS6djjTeIQPawQEEJryblTwYEgkX1sz8ZDzDzZOIrve9Clkup+ry5p0FBpIHhzyYM04q++L8MPrxQWZDsGYPVrdEEMd4oGrji0d8gPablbgqZroeMyHQlRLya8h10HEVLk5bvvKhDbyvmbCYo+DtSAopEfzjQwAqydB2ePoEuCFLZixu0nFcttMCxzjYhzTg3T0bFcZ63VeWF4IWdixszsvkt7FHx39u2MkmAvh7nmDf2+KogZQdcqSmmkFaA56XvVBR5Tyrmz6DiSqhHs/qUynL7fkA8XtG9MheoF0/bkQBArP3fv5LYnahRY9uQUQwOOq6MiDEW2e8owo5vg9NizQ53udF73/+SnP7UjyJ/hsPUrDc22quYylDGSOymBswsGm8hp/47hcqIaiXgY X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 14 Jul 2026 20:55:40.6296 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: b79a75eb-52fb-494c-33da-08dee1ea43ad X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.118.232];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: CY4PEPF0000FCBE.namprd03.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH8PR12MB7447 Content-Type: text/plain; charset="utf-8" tegra241_cmdqv_isr() logs the error-map registers on every error interrupt. A malfunctioning device, or a guest deliberately faulting its own VCMDQs, can raise these interrupts rapidly, and the unconditional dev_warn() then floods the kernel log. Rate-limit the message with dev_warn_ratelimited(), and pass the error-map registers straight to it so their four MMIO reads run only when the limiter prints, instead of building the string on every interrupt. Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Nicolin Chen --- drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-) diff --git a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c b/drivers/iommu= /arm/arm-smmu-v3/tegra241-cmdqv.c index d27ee215032f7..6fa981574db9f 100644 --- a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c +++ b/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c @@ -353,21 +353,19 @@ static irqreturn_t tegra241_cmdqv_isr(int irq, void *= devid) { struct tegra241_cmdqv *cmdqv =3D (struct tegra241_cmdqv *)devid; void __iomem *reg_vintf_map =3D REG_CMDQV(cmdqv, VINTF_ERR_MAP); - char err_str[256]; u64 vintf_map; =20 /* Use readl_relaxed() as register addresses are not 64-bit aligned */ vintf_map =3D (u64)readl_relaxed(reg_vintf_map + 0x4) << 32 | (u64)readl_relaxed(reg_vintf_map); =20 - snprintf(err_str, sizeof(err_str), - "vintf_map: %016llx, vcmdq_map %08x:%08x:%08x:%08x", vintf_map, - readl_relaxed(REG_CMDQV(cmdqv, CMDQ_ERR_MAP(3))), - readl_relaxed(REG_CMDQV(cmdqv, CMDQ_ERR_MAP(2))), - readl_relaxed(REG_CMDQV(cmdqv, CMDQ_ERR_MAP(1))), - readl_relaxed(REG_CMDQV(cmdqv, CMDQ_ERR_MAP(0)))); - - dev_warn(cmdqv->dev, "unexpected error reported. %s\n", err_str); + dev_warn_ratelimited( + cmdqv->dev, + "unexpected error reported. vintf_map: %016llx, vcmdq_map %08x:%08x:%08x= :%08x\n", + vintf_map, readl_relaxed(REG_CMDQV(cmdqv, CMDQ_ERR_MAP(3))), + readl_relaxed(REG_CMDQV(cmdqv, CMDQ_ERR_MAP(2))), + readl_relaxed(REG_CMDQV(cmdqv, CMDQ_ERR_MAP(1))), + readl_relaxed(REG_CMDQV(cmdqv, CMDQ_ERR_MAP(0)))); =20 /* Handle VINTF0 and its LVCMDQs */ if (vintf_map & BIT_ULL(0)) { --=20 2.43.0