* [PATCH rc] iommu/arm-smmu-v3: Fix smmu_domain->nr_ats_masters decrement
@ 2025-08-01 3:01 Nicolin Chen
2025-08-01 8:14 ` Pranjal Shrivastava
` (3 more replies)
0 siblings, 4 replies; 5+ messages in thread
From: Nicolin Chen @ 2025-08-01 3:01 UTC (permalink / raw)
To: jgg, will; +Cc: joro, robin.murphy, linux-arm-kernel, iommu, linux-kernel
The arm_smmu_attach_commit() updates master->ats_enabled before calling
arm_smmu_remove_master_domain() that is supposed to clean up everything
in the old domain, including the old domain's nr_ats_masters. So, it is
supposed to use the old ats_enabled state of the device, not an updated
state.
This isn't a problem if switching between two domains where:
- old ats_enabled = false; new ats_enabled = false
- old ats_enabled = true; new ats_enabled = true
but can fail cases where:
- old ats_enabled = false; new ats_enabled = true
(old domain should keep the counter but incorrectly decreased it)
- old ats_enabled = true; new ats_enabled = false
(old domain needed to decrease the counter but incorrectly missed it)
Update master->ats_enabled after arm_smmu_remove_master_domain() to fix
this.
Fixes: 7497f4211f4f ("iommu/arm-smmu-v3: Make changing domains be hitless for ATS")
Cc: stable@vger.kernel.org
Signed-off-by: Nicolin Chen <nicolinc@nvidia.com>
---
drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
index 312bc31d7e8eb..3c81139faecae 100644
--- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
+++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
@@ -2997,9 +2997,9 @@ void arm_smmu_attach_commit(struct arm_smmu_attach_state *state)
/* ATS is being switched off, invalidate the entire ATC */
arm_smmu_atc_inv_master(master, IOMMU_NO_PASID);
}
- master->ats_enabled = state->ats_enabled;
arm_smmu_remove_master_domain(master, state->old_domain, state->ssid);
+ master->ats_enabled = state->ats_enabled;
}
static int arm_smmu_attach_dev(struct iommu_domain *domain, struct device *dev)
--
2.43.0
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH rc] iommu/arm-smmu-v3: Fix smmu_domain->nr_ats_masters decrement
2025-08-01 3:01 [PATCH rc] iommu/arm-smmu-v3: Fix smmu_domain->nr_ats_masters decrement Nicolin Chen
@ 2025-08-01 8:14 ` Pranjal Shrivastava
2025-08-06 14:04 ` Jason Gunthorpe
` (2 subsequent siblings)
3 siblings, 0 replies; 5+ messages in thread
From: Pranjal Shrivastava @ 2025-08-01 8:14 UTC (permalink / raw)
To: Nicolin Chen
Cc: jgg, will, joro, robin.murphy, linux-arm-kernel, iommu,
linux-kernel
On Thu, Jul 31, 2025 at 08:01:27PM -0700, Nicolin Chen wrote:
> The arm_smmu_attach_commit() updates master->ats_enabled before calling
> arm_smmu_remove_master_domain() that is supposed to clean up everything
> in the old domain, including the old domain's nr_ats_masters. So, it is
> supposed to use the old ats_enabled state of the device, not an updated
> state.
>
> This isn't a problem if switching between two domains where:
> - old ats_enabled = false; new ats_enabled = false
> - old ats_enabled = true; new ats_enabled = true
> but can fail cases where:
> - old ats_enabled = false; new ats_enabled = true
> (old domain should keep the counter but incorrectly decreased it)
> - old ats_enabled = true; new ats_enabled = false
> (old domain needed to decrease the counter but incorrectly missed it)
>
> Update master->ats_enabled after arm_smmu_remove_master_domain() to fix
> this.
>
> Fixes: 7497f4211f4f ("iommu/arm-smmu-v3: Make changing domains be hitless for ATS")
> Cc: stable@vger.kernel.org
> Signed-off-by: Nicolin Chen <nicolinc@nvidia.com>
arm_smmu_remove_master_domain() needs to see the old ats_enabled state
for the cleanup.
Reviewed-by: Pranjal Shrivastava <praan@google.com>
Thanks,
Praan
> ---
> drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
> index 312bc31d7e8eb..3c81139faecae 100644
> --- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
> +++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
> @@ -2997,9 +2997,9 @@ void arm_smmu_attach_commit(struct arm_smmu_attach_state *state)
> /* ATS is being switched off, invalidate the entire ATC */
> arm_smmu_atc_inv_master(master, IOMMU_NO_PASID);
> }
> - master->ats_enabled = state->ats_enabled;
>
> arm_smmu_remove_master_domain(master, state->old_domain, state->ssid);
> + master->ats_enabled = state->ats_enabled;
> }
>
> static int arm_smmu_attach_dev(struct iommu_domain *domain, struct device *dev)
> --
> 2.43.0
>
>
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH rc] iommu/arm-smmu-v3: Fix smmu_domain->nr_ats_masters decrement
2025-08-01 3:01 [PATCH rc] iommu/arm-smmu-v3: Fix smmu_domain->nr_ats_masters decrement Nicolin Chen
2025-08-01 8:14 ` Pranjal Shrivastava
@ 2025-08-06 14:04 ` Jason Gunthorpe
2025-08-19 12:28 ` Will Deacon
2025-08-22 6:41 ` Joerg Roedel
3 siblings, 0 replies; 5+ messages in thread
From: Jason Gunthorpe @ 2025-08-06 14:04 UTC (permalink / raw)
To: Nicolin Chen
Cc: will, joro, robin.murphy, linux-arm-kernel, iommu, linux-kernel
On Thu, Jul 31, 2025 at 08:01:27PM -0700, Nicolin Chen wrote:
> The arm_smmu_attach_commit() updates master->ats_enabled before calling
> arm_smmu_remove_master_domain() that is supposed to clean up everything
> in the old domain, including the old domain's nr_ats_masters. So, it is
> supposed to use the old ats_enabled state of the device, not an updated
> state.
>
> This isn't a problem if switching between two domains where:
> - old ats_enabled = false; new ats_enabled = false
> - old ats_enabled = true; new ats_enabled = true
> but can fail cases where:
> - old ats_enabled = false; new ats_enabled = true
> (old domain should keep the counter but incorrectly decreased it)
> - old ats_enabled = true; new ats_enabled = false
> (old domain needed to decrease the counter but incorrectly missed it)
>
> Update master->ats_enabled after arm_smmu_remove_master_domain() to fix
> this.
>
> Fixes: 7497f4211f4f ("iommu/arm-smmu-v3: Make changing domains be hitless for ATS")
> Cc: stable@vger.kernel.org
> Signed-off-by: Nicolin Chen <nicolinc@nvidia.com>
> ---
> drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Jason
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH rc] iommu/arm-smmu-v3: Fix smmu_domain->nr_ats_masters decrement
2025-08-01 3:01 [PATCH rc] iommu/arm-smmu-v3: Fix smmu_domain->nr_ats_masters decrement Nicolin Chen
2025-08-01 8:14 ` Pranjal Shrivastava
2025-08-06 14:04 ` Jason Gunthorpe
@ 2025-08-19 12:28 ` Will Deacon
2025-08-22 6:41 ` Joerg Roedel
3 siblings, 0 replies; 5+ messages in thread
From: Will Deacon @ 2025-08-19 12:28 UTC (permalink / raw)
To: Nicolin Chen, joro
Cc: jgg, robin.murphy, linux-arm-kernel, iommu, linux-kernel
On Thu, Jul 31, 2025 at 08:01:27PM -0700, Nicolin Chen wrote:
> The arm_smmu_attach_commit() updates master->ats_enabled before calling
> arm_smmu_remove_master_domain() that is supposed to clean up everything
> in the old domain, including the old domain's nr_ats_masters. So, it is
> supposed to use the old ats_enabled state of the device, not an updated
> state.
>
> This isn't a problem if switching between two domains where:
> - old ats_enabled = false; new ats_enabled = false
> - old ats_enabled = true; new ats_enabled = true
> but can fail cases where:
> - old ats_enabled = false; new ats_enabled = true
> (old domain should keep the counter but incorrectly decreased it)
> - old ats_enabled = true; new ats_enabled = false
> (old domain needed to decrease the counter but incorrectly missed it)
>
> Update master->ats_enabled after arm_smmu_remove_master_domain() to fix
> this.
>
> Fixes: 7497f4211f4f ("iommu/arm-smmu-v3: Make changing domains be hitless for ATS")
> Cc: stable@vger.kernel.org
> Signed-off-by: Nicolin Chen <nicolinc@nvidia.com>
> ---
> drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
> index 312bc31d7e8eb..3c81139faecae 100644
> --- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
> +++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
> @@ -2997,9 +2997,9 @@ void arm_smmu_attach_commit(struct arm_smmu_attach_state *state)
> /* ATS is being switched off, invalidate the entire ATC */
> arm_smmu_atc_inv_master(master, IOMMU_NO_PASID);
> }
> - master->ats_enabled = state->ats_enabled;
>
> arm_smmu_remove_master_domain(master, state->old_domain, state->ssid);
> + master->ats_enabled = state->ats_enabled;
> }
>
> static int arm_smmu_attach_dev(struct iommu_domain *domain, struct device *dev)
> --
> 2.43.0
Acked-by: Will Deacon <will@kernel.org>
Joerg -- please can you pick this up as a fix?
Thanks,
Will
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH rc] iommu/arm-smmu-v3: Fix smmu_domain->nr_ats_masters decrement
2025-08-01 3:01 [PATCH rc] iommu/arm-smmu-v3: Fix smmu_domain->nr_ats_masters decrement Nicolin Chen
` (2 preceding siblings ...)
2025-08-19 12:28 ` Will Deacon
@ 2025-08-22 6:41 ` Joerg Roedel
3 siblings, 0 replies; 5+ messages in thread
From: Joerg Roedel @ 2025-08-22 6:41 UTC (permalink / raw)
To: Nicolin Chen
Cc: jgg, will, robin.murphy, linux-arm-kernel, iommu, linux-kernel
On Thu, Jul 31, 2025 at 08:01:27PM -0700, Nicolin Chen wrote:
> drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
Applied for -rc, thanks.
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2025-08-22 12:21 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-08-01 3:01 [PATCH rc] iommu/arm-smmu-v3: Fix smmu_domain->nr_ats_masters decrement Nicolin Chen
2025-08-01 8:14 ` Pranjal Shrivastava
2025-08-06 14:04 ` Jason Gunthorpe
2025-08-19 12:28 ` Will Deacon
2025-08-22 6:41 ` Joerg Roedel
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).