All of lore.kernel.org
 help / color / mirror / Atom feed
From: Baolu Lu <baolu.lu@linux.intel.com>
To: Nicolin Chen <nicolinc@nvidia.com>,
	joro@8bytes.org, kevin.tian@intel.com, jgg@nvidia.com
Cc: will@kernel.org, robin.murphy@arm.com, iommu@lists.linux.dev,
	linux-kernel@vger.kernel.org, xueshuai@linux.alibaba.com
Subject: Re: [PATCH rc v7 4/6] iommu: Fix nested pci_dev_reset_iommu_prepare/done()
Date: Fri, 24 Apr 2026 14:12:48 +0800	[thread overview]
Message-ID: <ef2b7197-3d07-44d8-9093-da88eb8f693a@linux.intel.com> (raw)
In-Reply-To: <ab6d836f38c31b76275b1372874641a925a136dc.1776551790.git.nicolinc@nvidia.com>

On 4/19/26 07:41, Nicolin Chen wrote:
> Shuai found that cxl_reset_bus_function() calls pci_reset_bus_function()
> internally while both are calling pci_dev_reset_iommu_prepare/done().
> 
> As pci_dev_reset_iommu_prepare() doesn't support re-entry, the inner call
> will trigger a WARN_ON and return -EBUSY, resulting in failing the entire
> device reset.
> 
> On the other hand, removing the outer calls in the PCI callers is unsafe.
> As pointed out by Kevin, device-specific quirks like reset_hinic_vf_dev()
> execute custom firmware waits after their inner pcie_flr() completes. If
> the IOMMU protection relies solely on the inner reset, the IOMMU will be
> unblocked prematurely while the device is still resetting.
> 
> Instead, fix this by making pci_dev_reset_iommu_prepare/done() reentrant.
> 
> Introduce gdev->reset_depth to handle the re-entries on the same device.
> 
> Fixes: c279e83953d9 ("iommu: Introduce pci_dev_reset_iommu_prepare/done()")
> Cc:stable@vger.kernel.org
> Reported-by: Shuai Xue<xueshuai@linux.alibaba.com>
> Closes:https://lore.kernel.org/all/absKsk7qQOwzhpzv@Asurada-Nvidia/
> Suggested-by: Kevin Tian<kevin.tian@intel.com>
> Reviewed-by: Shuai Xue<xueshuai@linux.alibaba.com>
> Reviewed-by: Jason Gunthorpe<jgg@nvidia.com>
> Reviewed-by: Kevin Tian<kevin.tian@intel.com>
> Signed-off-by: Nicolin Chen<nicolinc@nvidia.com>
> ---
>   drivers/iommu/iommu.c | 19 +++++++++++++------
>   1 file changed, 13 insertions(+), 6 deletions(-)

Reviewed-by: Lu Baolu <baolu.lu@linux.intel.com>

  reply	other threads:[~2026-04-24  6:14 UTC|newest]

Thread overview: 21+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-04-18 23:41 [PATCH rc v7 0/6] iommu: Fix pci_dev_reset_iommu_prepare/done() Nicolin Chen
2026-04-18 23:41 ` [PATCH rc v7 1/6] iommu: Fix kdocs of pci_dev_reset_iommu_done() Nicolin Chen
2026-04-24  5:09   ` Baolu Lu
2026-04-18 23:41 ` [PATCH rc v7 2/6] iommu: Replace per-group resetting_domain with per-gdev blocked flag Nicolin Chen
2026-04-24  5:27   ` Baolu Lu
2026-04-18 23:41 ` [PATCH rc v7 3/6] iommu: Fix pasid attach in pci_dev_reset_iommu_prepare/done() Nicolin Chen
2026-04-24  5:49   ` Baolu Lu
2026-04-24 19:28     ` Nicolin Chen
2026-04-18 23:41 ` [PATCH rc v7 4/6] iommu: Fix nested pci_dev_reset_iommu_prepare/done() Nicolin Chen
2026-04-24  6:12   ` Baolu Lu [this message]
2026-04-18 23:41 ` [PATCH rc v7 5/6] iommu: Fix ATS invalidation timeouts during __iommu_remove_group_pasid() Nicolin Chen
2026-04-21  7:15   ` Tian, Kevin
2026-04-21 17:57     ` Nicolin Chen
2026-04-22  2:03       ` Tian, Kevin
2026-04-24  6:23   ` Baolu Lu
2026-04-24 19:39     ` Nicolin Chen
2026-04-18 23:41 ` [PATCH rc v7 6/6] iommu: Fix UAF in pci_dev_reset_iommu_done() due to concurrent detach Nicolin Chen
2026-04-21  7:41   ` Tian, Kevin
2026-04-21 18:10     ` Nicolin Chen
2026-04-22  1:56       ` Tian, Kevin
2026-04-24  6:44   ` Baolu Lu

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=ef2b7197-3d07-44d8-9093-da88eb8f693a@linux.intel.com \
    --to=baolu.lu@linux.intel.com \
    --cc=iommu@lists.linux.dev \
    --cc=jgg@nvidia.com \
    --cc=joro@8bytes.org \
    --cc=kevin.tian@intel.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=nicolinc@nvidia.com \
    --cc=robin.murphy@arm.com \
    --cc=will@kernel.org \
    --cc=xueshuai@linux.alibaba.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.