Linux kernel -stable discussions
 help / color / mirror / Atom feed
From: Samiullah Khawaja <skhawaja@google.com>
To: Jason Gunthorpe <jgg@nvidia.com>
Cc: iommu@lists.linux.dev, Joerg Roedel <joro@8bytes.org>,
	 Robin Murphy <robin.murphy@arm.com>,
	Will Deacon <will@kernel.org>,
	 Alejandro Jimenez <alejandro.j.jimenez@oracle.com>,
	Lu Baolu <baolu.lu@linux.intel.com>,
	 Joerg Roedel <joerg.roedel@amd.com>,
	Josua Mayer <josua@solid-run.com>,
	 Kevin Tian <kevin.tian@intel.com>,
	Pasha Tatashin <pasha.tatashin@soleen.com>,
	 patches@lists.linux.dev, Pranjal Shrivastava <praan@google.com>,
	 Mostafa Saleh <smostafa@google.com>,
	stable@vger.kernel.org
Subject: Re: [PATCH rc 5/5] iommupt: Fix the end_index calculation in __map_range_leaf()
Date: Wed, 13 May 2026 18:53:40 +0000	[thread overview]
Message-ID: <agTHzU3KYofnszp4@google.com> (raw)
In-Reply-To: <5-v1-44b2fef88b25+d3-iommupt_map_rc_jgg@nvidia.com>

On Tue, May 12, 2026 at 01:46:17PM -0300, Jason Gunthorpe wrote:
>Sashiko noticed a mismatch of units in this math: num_leaves is
>actually the number of leaf *entries* (so a 16-item contiguous leaf
>is one num_leaves), while index is in items. The mismatch in maths
>causes __map_range_leaf() to exit early instead of efficiently
>filling a larger range of contiguous PTEs.
>
>The early exit is caught by the functions above and then
>__map_range_leaf() is re-invoked, so there is no functional issue.
>
>Correct the misuse of units by adjusting num_leaves with the leaf
>size and avoid the performance cost of looping externally.
>
>There are also some mismatched types for num_leaves; simplify
>things to remove the duplicated calculations.
>
>Fixes: d6c65b0fd621 ("iommupt: Avoid rewalking during map")
>Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
>---
> drivers/iommu/generic_pt/iommu_pt.h | 20 +++++++++++++-------
> 1 file changed, 13 insertions(+), 7 deletions(-)
>
>diff --git a/drivers/iommu/generic_pt/iommu_pt.h b/drivers/iommu/generic_pt/iommu_pt.h
>index 4877b05291c9d4..dc91fb4e2f61cb 100644
>--- a/drivers/iommu/generic_pt/iommu_pt.h
>+++ b/drivers/iommu/generic_pt/iommu_pt.h
>@@ -534,10 +534,12 @@ static int __map_range_leaf(struct pt_range *range, void *arg,
> 	struct pt_state pts = pt_init(range, level, table);
> 	struct pt_iommu_map_args *map = arg;
> 	unsigned int leaf_pgsize_lg2 = map->leaf_pgsize_lg2;
>+	unsigned int leaves_avail;
> 	unsigned int start_index;
> 	pt_oaddr_t oa = map->oa;
>-	unsigned int num_leaves;
>+	pt_vaddr_t num_leaves;
> 	unsigned int orig_end;
>+	unsigned int step_lg2;
> 	pt_vaddr_t last_va;
> 	unsigned int step;
> 	bool need_contig;
>@@ -546,21 +548,25 @@ static int __map_range_leaf(struct pt_range *range, void *arg,
> 	PT_WARN_ON(map->leaf_level != level);
> 	PT_WARN_ON(!pt_can_have_leaf(&pts));
>
>-	step = log2_to_int_t(unsigned int,
>-			     leaf_pgsize_lg2 - pt_table_item_lg2sz(&pts));
>-	need_contig = leaf_pgsize_lg2 != pt_table_item_lg2sz(&pts);
>+	step_lg2 = leaf_pgsize_lg2 - pt_table_item_lg2sz(&pts);
>+	step = log2_to_int_t(unsigned int, step_lg2);
>+	need_contig = step_lg2 != 0;
>
> 	_pt_iter_first(&pts);
> 	start_index = pts.index;
> 	orig_end = pts.end_index;
>-	if (pts.index + map->num_leaves < pts.end_index) {
>+	leaves_avail =
>+		log2_div_t(unsigned int, pts.end_index - pts.index, step_lg2);
>+	if (map->num_leaves <= leaves_avail) {
> 		/* Need to stop in the middle of the table to change sizes */
>-		pts.end_index = pts.index + map->num_leaves;
>+		pts.end_index = pts.index + log2_mul(map->num_leaves, step_lg2);
> 		num_leaves = 0;
> 	} else {
>-		num_leaves = map->num_leaves - (pts.end_index - pts.index);
>+		num_leaves = map->num_leaves - leaves_avail;
> 	}
>
>+	PT_WARN_ON(
>+		log2_mod_t(unsigned int, pts.end_index - pts.index, step_lg2));
> 	do {
> 		pts.type = pt_load_entry_raw(&pts);
> 		if (pts.type != PT_ENTRY_EMPTY || need_contig) {
>-- 
>2.43.0
>

Reviewed-by: Samiullah Khawaja <skhawaja@google.com>

Thanks,
Sami

  parent reply	other threads:[~2026-05-13 18:53 UTC|newest]

Thread overview: 25+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-05-12 16:46 [PATCH rc 0/5] Fix some iommupt mistakes from Sashiko Jason Gunthorpe
2026-05-12 16:46 ` [PATCH rc 1/5] iommu: Fix loss of errno on map failure for classic ops Jason Gunthorpe
2026-05-13 14:57   ` Mostafa Saleh
2026-05-13 16:32   ` Samiullah Khawaja
2026-05-13 17:42   ` Pranjal Shrivastava
2026-05-12 16:46 ` [PATCH rc 2/5] iommu: Fix up map/unmap debugging for iommupt domains Jason Gunthorpe
2026-05-13 15:11   ` Mostafa Saleh
2026-05-13 16:45   ` Samiullah Khawaja
2026-05-13 17:44   ` Pranjal Shrivastava
2026-05-12 16:46 ` [PATCH rc 3/5] iommu: Handle unmap error when iommu_debug is enabled Jason Gunthorpe
2026-05-13 15:13   ` Mostafa Saleh
2026-05-13 15:18     ` Jason Gunthorpe
2026-05-13 16:56   ` Samiullah Khawaja
2026-05-13 17:47   ` Pranjal Shrivastava
2026-05-12 16:46 ` [PATCH rc 4/5] iommupt: Check for missing PAGE_SIZE in the pgsize_bitmap Jason Gunthorpe
2026-05-13 17:46   ` Samiullah Khawaja
2026-05-13 17:57     ` Samiullah Khawaja
2026-05-13 18:06       ` Jason Gunthorpe
2026-05-13 18:48         ` Samiullah Khawaja
2026-05-13 21:03           ` Jason Gunthorpe
2026-05-13 17:48   ` Pranjal Shrivastava
2026-05-12 16:46 ` [PATCH rc 5/5] iommupt: Fix the end_index calculation in __map_range_leaf() Jason Gunthorpe
2026-05-13 17:58   ` Pranjal Shrivastava
2026-05-13 18:53   ` Samiullah Khawaja [this message]
2026-05-13 11:08 ` [PATCH rc 0/5] Fix some iommupt mistakes from Sashiko Josua Mayer

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=agTHzU3KYofnszp4@google.com \
    --to=skhawaja@google.com \
    --cc=alejandro.j.jimenez@oracle.com \
    --cc=baolu.lu@linux.intel.com \
    --cc=iommu@lists.linux.dev \
    --cc=jgg@nvidia.com \
    --cc=joerg.roedel@amd.com \
    --cc=joro@8bytes.org \
    --cc=josua@solid-run.com \
    --cc=kevin.tian@intel.com \
    --cc=pasha.tatashin@soleen.com \
    --cc=patches@lists.linux.dev \
    --cc=praan@google.com \
    --cc=robin.murphy@arm.com \
    --cc=smostafa@google.com \
    --cc=stable@vger.kernel.org \
    --cc=will@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox