Skip to contentSkip to conversation

iommu-sva-invalidate-stale-iotlb-entries-for-kernel-address-space.patch removed from -mm tree

merged mm-stable Andrew Morton 1 participant 1 message Nov 17, 2025

lore
Share & tools
lore

Andrew Morton

author tree notice Applied
#0 lore raw

The quilt patch titled
Subject: iommu/sva: invalidate stale IOTLB entries for kernel address space
has been removed from the -mm tree. Its filename was
iommu-sva-invalidate-stale-iotlb-entries-for-kernel-address-space.patch

This patch was dropped because it was merged into the mm-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

------------------------------------------------------
From: Lu Baolu <[email protected]>
Subject: iommu/sva: invalidate stale IOTLB entries for kernel address space
Date: Wed, 22 Oct 2025 16:26:34 +0800

Introduce a new IOMMU interface to flush IOTLB paging cache entries for the CPU kernel address space. This interface is invoked from the x86 architecture code that manages combined user and kernel page tables, specifically before any kernel page table page is freed and reused.

This addresses the main issue with vfree() which is a common occurrence and can be triggered by unprivileged users. While this resolves the primary problem, it doesn't address some extremely rare case related to memory unplug of memory that was present as reserved memory at boot, which cannot be triggered by unprivileged users. The discussion can be found at the link below.

Enable SVA on x86 architecture since the IOMMU can now receive notification to flush the paging cache before freeing the CPU kernel page table pages.

Link https://lkml.kernel.org/r/[email protected] open here
Link https://lore.kernel.org/linux-iommu/[email protected]/ open here
Co-developed-by Jason Gunthorpe <[email protected]>
Signed-off-by Jason Gunthorpe <[email protected]>
Signed-off-by Lu Baolu <[email protected]>
Suggested-by Jann Horn <[email protected]>
Reviewed-by Jason Gunthorpe <[email protected]>
Reviewed-by Vasant Hegde <[email protected]>
Reviewed-by Kevin Tian <[email protected]>
Cc Alistair Popple <[email protected]>
Cc Andy Lutomirski <[email protected]>
Cc Borislav Betkov <[email protected]>
Cc Dave Hansen <[email protected]>
Cc David Hildenbrand <[email protected]>
Cc Ingo Molnar <[email protected]>
Cc Jean-Philippe Brucker <[email protected]>
Cc Joerg Roedel <[email protected]>
Cc Liam Howlett <[email protected]>
Cc Lorenzo Stoakes <[email protected]>
Cc Matthew Wilcox (Oracle) <[email protected]>
Cc Michal Hocko <[email protected]>
Cc Mike Rapoport (Microsoft) <[email protected]>
Cc Peter Zijlstra <[email protected]>
Cc Robin Murohy <[email protected]>
Cc Thomas Gleinxer <[email protected]>
Cc "Uladzislau Rezki (Sony)" <[email protected]>
Cc Vinicius Costa Gomes <[email protected]>
Cc Vlastimil Babka <[email protected]>
Cc Will Deacon <[email protected]>
Cc Yi Lai <[email protected]>
Signed-off-by Andrew Morton <[email protected]>

---

 arch/x86/Kconfig          |    1 +
 drivers/iommu/iommu-sva.c |   32 ++++++++++++++++++++++++++++----
 include/linux/iommu.h     |    4 ++++
 mm/pgtable-generic.c      |    2 ++
 4 files changed, 35 insertions(+), 4 deletions(-)
arch/x86/Kconfig renamed from arch/x86/Kconfig~iommu-sva-invalidate-stale-iotlb-entries-for-kernel-address-space +1 -0
@@ -279,6 +279,7 @@ config X86
 	select HAVE_PCI
 	select HAVE_PERF_REGS
 	select HAVE_PERF_USER_STACK_DUMP
+	select ASYNC_KERNEL_PGTABLE_FREE	if IOMMU_SVA
 	select MMU_GATHER_RCU_TABLE_FREE
 	select MMU_GATHER_MERGE_VMAS
 	select HAVE_POSIX_CPU_TIMERS_TASK_WORK
drivers/iommu/iommu-sva.c renamed from drivers/iommu/iommu-sva.c~iommu-sva-invalidate-stale-iotlb-entries-for-kernel-address-space +28 -4
@@ -10,6 +10,8 @@
 #include "iommu-priv.h"
 
 static DEFINE_MUTEX(iommu_sva_lock);
+static bool iommu_sva_present;
+static LIST_HEAD(iommu_sva_mms);
 static struct iommu_domain *iommu_sva_domain_alloc(struct device *dev,
 						   struct mm_struct *mm);
 

@@ -42,6 +44,7 @@ static struct iommu_mm_data *iommu_alloc
 		return ERR_PTR(-ENOSPC);
 	}
 	iommu_mm->pasid = pasid;
+	iommu_mm->mm = mm;
 	INIT_LIST_HEAD(&iommu_mm->sva_domains);
 	/*
 	 * Make sure the write to mm->iommu_mm is not reordered in front of

@@ -77,9 +80,6 @@ struct iommu_sva *iommu_sva_bind_device(
 	if (!group)
 		return ERR_PTR(-ENODEV);
 
-	if (IS_ENABLED(CONFIG_X86))
-		return ERR_PTR(-EOPNOTSUPP);
-
 	mutex_lock(&iommu_sva_lock);
 
 	/* Allocate mm->pasid if necessary. */

@@ -135,8 +135,13 @@ struct iommu_sva *iommu_sva_bind_device(
 	if (ret)
 		goto out_free_domain;
 	domain->users = 1;
-	list_add(&domain->next, &mm->iommu_mm->sva_domains);
 
+	if (list_empty(&iommu_mm->sva_domains)) {
+		if (list_empty(&iommu_sva_mms))
+			iommu_sva_present = true;
+		list_add(&iommu_mm->mm_list_elm, &iommu_sva_mms);
+	}
+	list_add(&domain->next, &iommu_mm->sva_domains);
 out:
 	refcount_set(&handle->users, 1);
 	mutex_unlock(&iommu_sva_lock);

@@ -178,6 +183,13 @@ void iommu_sva_unbind_device(struct iomm
 		list_del(&domain->next);
 		iommu_domain_free(domain);
 	}
+
+	if (list_empty(&iommu_mm->sva_domains)) {
+		list_del(&iommu_mm->mm_list_elm);
+		if (list_empty(&iommu_sva_mms))
+			iommu_sva_present = false;
+	}
+
 	mutex_unlock(&iommu_sva_lock);
 	kfree(handle);
 }

@@ -315,3 +327,15 @@ static struct iommu_domain *iommu_sva_do
 
 	return domain;
 }
+
+void iommu_sva_invalidate_kva_range(unsigned long start, unsigned long end)
+{
+	struct iommu_mm_data *iommu_mm;
+
+	guard(mutex)(&iommu_sva_lock);
+	if (!iommu_sva_present)
+		return;
+
+	list_for_each_entry(iommu_mm, &iommu_sva_mms, mm_list_elm)
+		mmu_notifier_arch_invalidate_secondary_tlbs(iommu_mm->mm, start, end);
+}
include/linux/iommu.h renamed from include/linux/iommu.h~iommu-sva-invalidate-stale-iotlb-entries-for-kernel-address-space +4 -0
@@ -1134,7 +1134,9 @@ struct iommu_sva {
 
 struct iommu_mm_data {
 	u32			pasid;
+	struct mm_struct	*mm;
 	struct list_head	sva_domains;
+	struct list_head	mm_list_elm;
 };
 
 int iommu_fwspec_init(struct device *dev, struct fwnode_handle *iommu_fwnode);

@@ -1615,6 +1617,7 @@ struct iommu_sva *iommu_sva_bind_device(
 					struct mm_struct *mm);
 void iommu_sva_unbind_device(struct iommu_sva *handle);
 u32 iommu_sva_get_pasid(struct iommu_sva *handle);
+void iommu_sva_invalidate_kva_range(unsigned long start, unsigned long end);
 #else
 static inline struct iommu_sva *
 iommu_sva_bind_device(struct device *dev, struct mm_struct *mm)

@@ -1639,6 +1642,7 @@ static inline u32 mm_get_enqcmd_pasid(st
 }
 
 static inline void mm_pasid_drop(struct mm_struct *mm) {}
+static inline void iommu_sva_invalidate_kva_range(unsigned long start, unsigned long end) {}
 #endif /* CONFIG_IOMMU_SVA */
 
 #ifdef CONFIG_IOMMU_IOPF
mm/pgtable-generic.c renamed from mm/pgtable-generic.c~iommu-sva-invalidate-stale-iotlb-entries-for-kernel-address-space +2 -0
@@ -13,6 +13,7 @@
 #include <linux/swap.h>
 #include <linux/swapops.h>
 #include <linux/mm_inline.h>
+#include <linux/iommu.h>
 #include <asm/pgalloc.h>
 #include <asm/tlb.h>
 

@@ -430,6 +431,7 @@ static void kernel_pgtable_work_func(str
 	list_splice_tail_init(&kernel_pgtable_work.list, &page_list);
 	spin_unlock(&kernel_pgtable_work.lock);
 
+	iommu_sva_invalidate_kva_range(PAGE_OFFSET, TLB_FLUSH_ALL);
 	list_for_each_entry_safe(pt, next, &page_list, pt_list)
 		__pagetable_free(pt);
 }

_

Patches currently in -mm which might be from [email protected] are