From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.ozlabs.org (lists.ozlabs.org [112.213.38.117]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 1AD8ECC6B34 for ; Thu, 15 Oct 2026 12:02:38 +0000 (UTC) Received: from boromir.ozlabs.org (localhost [127.0.0.1]) by lists.ozlabs.org (Postfix) with ESMTP id 4j56C03mJTz2xMQ; Thu, 15 Oct 2026 23:02:36 +1100 (AEDT) Authentication-Results: lists.ozlabs.org; arc=none smtp.remote-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=lists.ozlabs.org; s=201707; t=1792065756; cv=none; b=aggBOEFgUPcf7LyRXBulfuK3o+gXCCXRQV8oBVDnAHUcm+jJqrWmAVfq+SDpQGLLTUr/bURzfHEDIKtpLWNcVmKrFYDk9OnaLE3ETmhtl09BXSRrcPyON0dELGTL4zRfl3o06R7i25BOE4hT/3XCe4jcRgTwjWRgrvKXZWi/Kf/q2BWYjuPRqo4Hfg1RPHuI4zHXmSOgRIL7q+5t+YJEIB/VOn885iMk5phhviRX/YKc25kSSQju3/xdN7m44f8lZB/vAgX0xby8fQ12+lan+VKeWVI5LWotnetHHlwAAdy+eQI/eksrLZpIzLJnd2lM2wJMMFwvRIdrejRnl77gzg== ARC-Message-Signature: i=1; a=rsa-sha256; d=lists.ozlabs.org; s=201707; t=1792065756; c=relaxed/relaxed; bh=locun8ff2u85xFcCJpcxGMt3fOvIahGuElM0G4kdsjE=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=jXN6mDx2DKdIsgKLpprKLKLKII+wZNoSFffBEe5T0mgGCCK6aenfS5278+ft7IwL0p/0rnGl+4QQKuoyzINPbPsOFO9zQ2rsnARKIZ0j0rsoh4zNRpSKr9Uin+hOz+FK/ypliaQU1aENL2/Nepq4N2D3Uq2oobMQEJV9nWj0vtKN1zoLkcQTwtMGEovfdYfcW/zvX751QKUFMB4h9U+sh2hXIfvVXvJWro8swTDKpr3RIP0XFvayPSuDvcT6BrSqSItiiGWqgwgmst6mg1vUuHcogfCzvUhS9UFbJoSne3SiA3MjKUrxaaDTh+jDYTXI0vfKXNWmN5b9u+b62Mbc/g== ARC-Authentication-Results: i=1; lists.ozlabs.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; dkim=pass (2048-bit key; unprotected) header.d=ibm.com header.i=@ibm.com header.a=rsa-sha256 header.s=pp1 header.b=KZN+lQD3; dkim-atps=neutral; spf=pass (client-ip=148.163.156.1; helo=mx0a-001b2d01.pphosted.com; envelope-from=nnmlinux@linux.ibm.com; receiver=lists.ozlabs.org) smtp.mailfrom=linux.ibm.com Authentication-Results: lists.ozlabs.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: lists.ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=ibm.com header.i=@ibm.com header.a=rsa-sha256 header.s=pp1 header.b=KZN+lQD3; dkim-atps=neutral Authentication-Results: lists.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=linux.ibm.com (client-ip=148.163.156.1; helo=mx0a-001b2d01.pphosted.com; envelope-from=nnmlinux@linux.ibm.com; receiver=lists.ozlabs.org) Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by lists.ozlabs.org (Postfix) with ESMTPS id 4j56Bz5HSzz2xGg for ; Thu, 15 Oct 2026 23:02:35 +1100 (AEDT) Received: from pps.filterd (m0356517.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 69F9kLvU531670; Thu, 15 Oct 2026 12:02:20 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:message-id:mime-version :subject:to; s=pp1; bh=locun8ff2u85xFcCJpcxGMt3fOvIahGuElM0G4kds jE=; b=KZN+lQD3hjUCsic6eI8ee+0xqm8NVKZMCZ16vvnqYbBeMjhJ5Rys3IXbu b8TnCAMxYFtgVfdt/M4HwnBY6/YpdVK01DPAyk/j4uTV1hlP6JRj4QdBbXKQmZL4 zGR3sO4L6TbRZOFR6x0oOEtoU0PL7Jyo5qWPbcjJOLk2Hv7CWCBiqFt7QaI8QRA3 +w0vdLGNHXqe9Bwt9P8AVNZxN9wn19M1sSINW92DsHuxnLQfOMFmdqEaZwvE0tal mwze+F3G7pQKfzZZOhUR1oQxPdS+7fxfXP3YVhdRzdA3kmjkaGeA/NB2yMTpT6oZ t25keoNVhmqCihWSq0xvPm0TRlcdw== Received: from ppma21.wdc07v.mail.ibm.com (5b.69.3da9.ip4.static.sl-reverse.com [169.61.105.91]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4h7dv3sq1m-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Thu, 15 Oct 2026 12:02:20 +0000 (GMT) Received: from pps.filterd (ppma21.wdc07v.mail.ibm.com [127.0.0.1]) by ppma21.wdc07v.mail.ibm.com (8.18.1.11/8.18.1.11) with ESMTP id 69F9ntdQ1891164; Thu, 15 Oct 2026 12:02:19 GMT Received: from smtprelay06.fra02v.mail.ibm.com ([9.218.2.230]) by ppma21.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4h9q2ysatk-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 15 Oct 2026 12:02:19 +0000 (GMT) Received: from smtpav03.fra02v.mail.ibm.com (smtpav03.fra02v.mail.ibm.com [10.20.54.102]) by smtprelay06.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 69FC2F7U49742278 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 15 Oct 2026 12:02:15 GMT Received: from smtpav03.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 16B4420043; Thu, 15 Oct 2026 12:02:15 +0000 (GMT) Received: from smtpav03.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 596BE20040; Thu, 15 Oct 2026 12:02:12 +0000 (GMT) Received: from Narayanas-MacBook-Pro.ibm.com (unknown [9.39.29.169]) by smtpav03.fra02v.mail.ibm.com (Postfix) with ESMTP; Thu, 15 Oct 2026 12:02:12 +0000 (GMT) From: Narayana Murty N To: Madhavan Srinivasan , linuxppc-dev@lists.ozlabs.org, kvm@vger.kernel.org Cc: Nicholas Piggin , Michael Ellerman , Christophe Leroy , Ritesh Harjani , Shrikanth Hegde , Alexey Kardashevskiy , stable@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH v1 1/1] KVM: PPC: Book3S: Protect TCE IOMMU table walks with RCU Date: Thu, 15 Oct 2026 17:31:37 +0530 Message-ID: <20261015120137.28843-1-nnmlinux@linux.ibm.com> X-Mailer: git-send-email 2.54.0 X-Mailing-List: linuxppc-dev@lists.ozlabs.org List-Id: List-Help: List-Owner: List-Post: List-Archive: , List-Subscribe: , , List-Unsubscribe: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-TM-AS-GCONF: 00 X-Proofpoint-Reinject: loops=2 maxloops=12 X-Proofpoint-GUID: 1WAN7T4O-doXYrz1-eOQ0s57d3CV7HFd X-Proofpoint-ORIG-GUID: elbUbtBM_G0zj52YCSSwR8rqL9TJHCIZ X-Authority-Analysis: v=2.4 cv=aqInmiZV c=1 sm=1 tr=0 ts=6ad0c0cc cx=c_pps a=GFwsV6G8L6GxiO2Y/PsHdQ==:117 a=GFwsV6G8L6GxiO2Y/PsHdQ==:17 a=660iZSQnnn4A:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=U7nrCbtTmkRpXpFmAIza:22 a=VwQbUJbxAAAA:8 a=VnNF1IyMAAAA:8 a=h1-L7VZ7pQEXAjHVqXwA:9 X-Proofpoint-Spam-Info: AW1haW4tMjYxMDE1MDA0NiBTYWx0ZWRfX7dyVA/CBAjJU JQFrbAlG5OW48GOeSxVLiJVT4wOkx69OKJnkTz/z/NAq27URr33dL8/R9GxL7kN49gl01/dq5WM Wp8NwaJTspVmtAFn0HKbpbHGCzN5RGg= X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYxMDE1MDA0NiBTYWx0ZWRfX0KetqF6ZPEvB os8OU0yuAh0uLX4kDSeDU9TgqRuir1RL7mBXnr16htwDXh8jvqXWbG60jyXktKrsJ61MTIiX5JN Ew7LyBPfap+ZD/EVwaTNOmAOE6ynZGtyhXjXjFjCLGSWMNSwVJCOr4nW3mdjGlC1J7EbEk0mfOq PlKqdLgDPgn1mMcBuPOnhLDI5IMzHmfasTbDRMzWnTgYBpgWfAqVg6ecyYM5T53z72Xgaq6MUtD N7b68oOBf9k1BmX8KLZ+qkiAVw6b5w+u6w1+XQm98Vuj0W8bq4h/k9B+zgTYKw9+pFW8Ou4sitt QDb5/ITNUid6PLs/laG/Il4O9BJp4xDTkuoQakSp9tHKMz8eI9I6CYH4tvy3Iv/vOoJD0SXDZgl Vowadk2x4IhsUgdZDcoIJf021yZrJAEgrLGg2CtvMkY13NrD4Yu6fNlk3rgC9V8gCU8T86HkVFb xhaA+2CkVh9eK/aCEQg== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-10-14_01,2026-10-14_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 phishscore=0 clxscore=1015 spamscore=0 malwarescore=0 suspectscore=0 bulkscore=0 adultscore=0 impostorscore=0 priorityscore=1501 lowpriorityscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2610080000 definitions=main-2610150046 Commit cad32d9d42e8 ("KVM: PPC: Book3s: Retire H_PUT_TCE/etc real mode handlers") moved the TCE hcalls from real mode to preemptible virtual mode. The stt->iommu_tables list is RCU managed. Entries are added with list_add_rcu(), removed with list_del_rcu(), and released after an RCU grace period with call_rcu(). However, kvmppc_h_put_tce(), kvmppc_h_put_tce_indirect(), and kvmppc_h_stuff_tce() traverse iommu_tables using list_for_each_entry_lockless() without an RCU read-side critical section. A concurrent IOMMU table detach can therefore remove an entry while a TCE hcall is traversing or using it, without the traversal preventing the entry from being reclaimed. Use list_for_each_entry_rcu() under rcu_read_lock() for these walks so that an entry removed concurrently is not reclaimed until the reader has completed. Fixes: cad32d9d42e8 ("KVM: PPC: Book3s: Retire H_PUT_TCE/etc real mode handlers") Cc: stable@vger.kernel.org Signed-off-by: Narayana Murty N --- arch/powerpc/kvm/book3s_64_vio.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/arch/powerpc/kvm/book3s_64_vio.c b/arch/powerpc/kvm/book3s_64_vio.c index c5f3f5b29d89..d8625488c3c5 100644 --- a/arch/powerpc/kvm/book3s_64_vio.c +++ b/arch/powerpc/kvm/book3s_64_vio.c @@ -602,7 +602,8 @@ long kvmppc_h_put_tce(struct kvm_vcpu *vcpu, unsigned long liobn, entry = ioba >> stt->page_shift; - list_for_each_entry_lockless(stit, &stt->iommu_tables, next) { + rcu_read_lock(); + list_for_each_entry_rcu(stit, &stt->iommu_tables, next) { if (dir == DMA_NONE) ret = kvmppc_tce_iommu_unmap(vcpu->kvm, stt, stit->tbl, entry); @@ -613,9 +614,11 @@ long kvmppc_h_put_tce(struct kvm_vcpu *vcpu, unsigned long liobn, if (ret != H_SUCCESS) { kvmppc_clear_tce(vcpu->kvm->mm, stt, stit->tbl, entry); + rcu_read_unlock(); goto unlock_exit; } } + rcu_read_unlock(); kvmppc_tce_put(stt, entry, tce); @@ -697,7 +700,8 @@ long kvmppc_h_put_tce_indirect(struct kvm_vcpu *vcpu, goto unlock_exit; } - list_for_each_entry_lockless(stit, &stt->iommu_tables, next) { + rcu_read_lock(); + list_for_each_entry_rcu(stit, &stt->iommu_tables, next) { ret = kvmppc_tce_iommu_map(vcpu->kvm, stt, stit->tbl, entry + i, ua, iommu_tce_direction(tce)); @@ -705,9 +709,11 @@ long kvmppc_h_put_tce_indirect(struct kvm_vcpu *vcpu, if (ret != H_SUCCESS) { kvmppc_clear_tce(vcpu->kvm->mm, stt, stit->tbl, entry + i); + rcu_read_unlock(); goto unlock_exit; } } + rcu_read_unlock(); kvmppc_tce_put(stt, entry + i, tce); } @@ -739,7 +745,8 @@ long kvmppc_h_stuff_tce(struct kvm_vcpu *vcpu, if (tce_value & (TCE_PCI_WRITE | TCE_PCI_READ)) return H_PARAMETER; - list_for_each_entry_lockless(stit, &stt->iommu_tables, next) { + rcu_read_lock(); + list_for_each_entry_rcu(stit, &stt->iommu_tables, next) { unsigned long entry = ioba >> stt->page_shift; for (i = 0; i < npages; ++i) { @@ -749,13 +756,16 @@ long kvmppc_h_stuff_tce(struct kvm_vcpu *vcpu, if (ret == H_SUCCESS) continue; - if (ret == H_TOO_HARD) + if (ret == H_TOO_HARD) { + rcu_read_unlock(); return ret; + } WARN_ON_ONCE(1); kvmppc_clear_tce(vcpu->kvm->mm, stt, stit->tbl, entry + i); } } + rcu_read_unlock(); for (i = 0; i < npages; ++i, ioba += (1ULL << stt->page_shift)) kvmppc_tce_put(stt, ioba >> stt->page_shift, tce_value); -- 2.54.0