From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 02EAC4128A3; Sat, 28 Feb 2026 17:44:58 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772300699; cv=none; b=PMbtX8oCQrgH9cGbqAaXS9cRwuqtYS2UsXIN4xzrm/oht2sXIeyktv4LPvhhYoZ6eXiIZct8nxqj5rnVA9AS2kF1JuJFPrDtw2bsXgJRiZFKq26oLV5O0KSgcuLf/7O4BqnVkQjizf+Jwozv5D7hy2zu6FEWT/jhHgHfXhXFwKQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772300699; c=relaxed/simple; bh=zmUkgrODlewI86AyQNZRMWa4ZdLSddABDb6WSKeLnjA=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=scD2tbW8ghd1nXscLpV1YuoCQzfUIpchg3HOaHZ29ffrQYS8Z4Y0b+jDhMfIwpRfYMggGX303+tTu89nSj0sjS0+OtGcWaI3pHpfy8z1M58WJqxZcOCJyy+JUf5lKBRZDGkejDU4X0U67rSlVyS5t8hzP5JKPznqFilKAnF6djU= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=LBqX4Tl8; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="LBqX4Tl8" Received: by smtp.kernel.org (Postfix) with ESMTPSA id E8525C19425; Sat, 28 Feb 2026 17:44:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1772300698; bh=zmUkgrODlewI86AyQNZRMWa4ZdLSddABDb6WSKeLnjA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=LBqX4Tl8glZmHrPvOFi3zqTZG9iJMGN/55gRjedHGIuEHXyv9wwALwzRBSDhh0XlX nOMjrdO+iSB0cm2uzXzwr++Hbvs/FD/dPgR4vI8QWcpclvRct8dWI3HdLKGsQTVUn0 WMGNXvqHHLuv1vqc1946FHknxp1vnnXFxOHws0c6H2CyGMSPvDj2Ij7zv9SpzLgF4R gt6iuqwuv2mtRrQu89t3UbMothsAwHQ36IrYF57JH6qDDjLYcROH89SsyVSbCxZJuX Aj821CXQwF921Wgh2qGowgatDZGacayGHmMIE716yD/J21jjjccRDzkxFkWHzO4kPa nreSVwiLkfghw== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Yu Zhang , Jason Gunthorpe , Joerg Roedel , Sasha Levin Subject: [PATCH 6.19 734/844] iommupt: Always add IOVA range to iotlb_gather in gather_range_pages() Date: Sat, 28 Feb 2026 12:30:47 -0500 Message-ID: <20260228173244.1509663-735-sashal@kernel.org> X-Mailer: git-send-email 2.51.0 In-Reply-To: <20260228173244.1509663-1-sashal@kernel.org> References: <20260228173244.1509663-1-sashal@kernel.org> Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit From: Yu Zhang [ Upstream commit b48ca920613858b477f75946907e72c74570af05 ] Add current (iova, len) to the iotlb gather, regardless of the setting of PT_FEAT_FLUSH_RANGE or PT_FEAT_FLUSH_RANGE_NO_GAPS. In gather_range_pages(), the current IOVA range is only added to iotlb_gather when PT_FEAT_FLUSH_RANGE is set. Yet a virtual IOMMU with NpCache uses only PT_FEAT_FLUSH_RANGE_NO_GAPS. In that case, iotlb_gather will stay empty (start=ULONG_MAX, end=0) after initialization, and the current (iova, len) will not be added to the iotlb_gather, causing subsequent iommu_iotlb_sync() to perform IOTLB invalidation with wrong parameters (e.g., amd_iommu_iotlb_sync() computes size from gather->end - gather->start + 1, leading to an invalid range). The disjoint check and sync for PT_FEAT_FLUSH_RANGE_NO_GAPS remain unchanged: when the new range is disjoint from the existing gather, we still sync first and then add the new range, so semantics for NO_GAPS are preserved. Fixes: 7c53f4238aa8 ("iommupt: Add unmap_pages op") Cc: stable@vger.kernel.org Reviewed-by: Jason Gunthorpe Signed-off-by: Yu Zhang Signed-off-by: Joerg Roedel Signed-off-by: Sasha Levin --- drivers/iommu/generic_pt/iommu_pt.h | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/iommu/generic_pt/iommu_pt.h b/drivers/iommu/generic_pt/iommu_pt.h index d575f3ba9d341..3e33fe64feab2 100644 --- a/drivers/iommu/generic_pt/iommu_pt.h +++ b/drivers/iommu/generic_pt/iommu_pt.h @@ -58,10 +58,9 @@ static void gather_range_pages(struct iommu_iotlb_gather *iotlb_gather, * Note that the sync frees the gather's free list, so we must * not have any pages on that list that are covered by iova/len */ - } else if (pt_feature(common, PT_FEAT_FLUSH_RANGE)) { - iommu_iotlb_gather_add_range(iotlb_gather, iova, len); } + iommu_iotlb_gather_add_range(iotlb_gather, iova, len); iommu_pages_list_splice(free_list, &iotlb_gather->freelist); } -- 2.51.0