From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AE96B2C3255; Tue, 28 Jul 2026 01:35:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785202518; cv=none; b=f9zmY3b51YvO9Q9a4GRZcaojiDz8XCRAHC8jQUjrhNiMPrgSTFrglIKhOVpNM87xEc9zFjJ5EFZJ/Z2QvUL0pNv8EOLmTkGToyBhum7uyLmM8CArFb71jOoWD9LwZpJmXDqQ2lNjLNpbHIhh4VA1FMLLFOayVC0JyInkZXhurK8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785202518; c=relaxed/simple; bh=vJs9xc/30hDx9JGZIF0UswmCWppURTGwpARUb6jic0E=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=H0t9whuxw1hPxGH/ocXqdLPH12hyrQydogGHGHyLHUPPS5dzmgHIsqtxhmKY6coE2rPPGOnlBLiHMCCIo47H5qyoT1VJ9RmsCwlrzewyl9zeU9N8iKNbSWlLCAkS4txhV+wTbsDi1Y+5j86indV5534H8ZG8yj6PLG4EPVWTTto= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=OO1Q5z8F; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="OO1Q5z8F" Received: from pps.filterd (m0353725.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66S0m42f3674514; Tue, 28 Jul 2026 01:35:15 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=pehW+LNYXXMR8byif W1tmfAYrofliG2hjo0xlZC76H0=; b=OO1Q5z8Fz9d/6OyLSYD1hJHOHXGWeeby6 GGci4Fp5K0aBexUCY5ye99T+2xGN25BwZj65MD7h2lQH06btczLySqpPzinwIJJq IUocDRFrBvOFcZAXrf0hisJx8o8ZIi54AZyt2gmuhB0Wl137WwewsuyAqI/81jZx ytwG+noE/Dc54jIj14S0eT5LcQ+ROFD2RYwi9gPqyXvfSxAHtACbx57xvL/Um+tL DhUcJykxlDNolZU9P+jhwoc3Ne9fQ+eOQGnSFytN3WmNlQ6KWBzYBRQzbVCfvuiC +GvoojL5O4LfXp6E4x7JvydqHKqWuBHe9uDWtspDzh9ZC72x2BWkA== Received: from ppma12.dal12v.mail.ibm.com (dc.9e.1632.ip4.static.sl-reverse.com [50.22.158.220]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fmv0njc4a-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 28 Jul 2026 01:35:15 +0000 (GMT) Received: from pps.filterd (ppma12.dal12v.mail.ibm.com [127.0.0.1]) by ppma12.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 66S1QQk1029311; Tue, 28 Jul 2026 01:35:14 GMT Received: from smtprelay02.fra02v.mail.ibm.com ([9.218.2.226]) by ppma12.dal12v.mail.ibm.com (PPS) with ESMTPS id 4fn7fq7x1m-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 28 Jul 2026 01:35:14 +0000 (GMT) Received: from smtpav06.fra02v.mail.ibm.com (smtpav06.fra02v.mail.ibm.com [10.20.54.105]) by smtprelay02.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 66S1ZAbA46661978 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 28 Jul 2026 01:35:11 GMT Received: from smtpav06.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id DEDB520092; Tue, 28 Jul 2026 01:35:10 +0000 (GMT) Received: from smtpav06.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id C052320091; Tue, 28 Jul 2026 01:35:10 +0000 (GMT) Received: from tuxmaker.boeblingen.de.ibm.com (unknown [9.87.85.9]) by smtpav06.fra02v.mail.ibm.com (Postfix) with SMTP; Tue, 28 Jul 2026 01:35:10 +0000 (GMT) Received: by tuxmaker.boeblingen.de.ibm.com (Postfix, from userid 4958) id 7BA5E162822; Tue, 28 Jul 2026 03:35:10 +0200 (CEST) From: Eric Farman To: linux-s390@vger.kernel.org, kvm@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Matthew Rosato , Halil Pasic , Christian Borntraeger , Eric Farman , stable@vger.kernel.org Subject: [PATCH v8 04/10] s390/vfio_ccw: ensure first IDAW remains constant Date: Tue, 28 Jul 2026 03:35:03 +0200 Message-ID: <20260728013509.1551753-5-farman@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260728013509.1551753-1-farman@linux.ibm.com> References: <20260728013509.1551753-1-farman@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzI4MDAwOSBTYWx0ZWRfX2PUMxhIwqK/X /48Lwd5q5LG/y62HFFtW1ry2ZkYnB00Waz1nLdX3Xh2JY2IfAkduTZnKmgRS6bYTeKx483lr7DQ L+mt+kyzsiAK4EtepwpId1TSTbwwFTw= X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzI4MDAwOSBTYWx0ZWRfXyYCTxscF/gej QmgD4Av4tMzTpa1z+06mZ5bc0+yIrnI2SSaJVMyqTiHi/J07pV0wJeZGIKGwQYtBvWl3RQAzS7j YljCgLetvzvSIxNCFCuwpX+7LeWeHgIpYhMdL/Qni9KRD6VYucMr4y1NPhuzAAOjay5o7SWsvNj 5gLgTJUUIic1WmyWbKb+jTmkbtpjvq5/p7DuMkucp2QNormLz1a3ghxi6hOp8YQxDml1dgfR9nt Fr6ZDq339HAxB2kQjtkSCLX/Si32rn+mU29LYdq6ntYdLaAi3RsN11XN8GxtaS1YuOvdMB+Su9g oiqqLsAfXewnQc4KxpoJdY0zpWETZ32zv8Sw1mAwVbhLfTsHk9IvU9c9zmlTJstB1rHIt6LGksn CGwBR/zjjTiNaCEgcbKhmWvKMgJR7v/hFY+uIg403L0JQh5Xv4vmP9EBrxd0yA4YrejCUkBqCPc 7lE2vBeAwZiNmiSxlqw== X-Authority-Analysis: v=2.4 cv=b5WCJNGx c=1 sm=1 tr=0 ts=6a680753 cx=c_pps a=bLidbwmWQ0KltjZqbj+ezA==:117 a=bLidbwmWQ0KltjZqbj+ezA==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=V8glGbnc2Ofi9Qvn3v5h:22 a=VwQbUJbxAAAA:8 a=VnNF1IyMAAAA:8 a=TyQ-expsAN5g-WtpmiwA:9 X-Proofpoint-GUID: lAANxgtfLvNWjl7H8X-ZWl-U45mpqjgy X-Proofpoint-ORIG-GUID: lAANxgtfLvNWjl7H8X-ZWl-U45mpqjgy X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-27_07,2026-07-27_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 spamscore=0 adultscore=0 malwarescore=0 impostorscore=0 bulkscore=0 phishscore=0 suspectscore=0 clxscore=1015 lowpriorityscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607280009 The first IDAW in a list does not need to be on a 2K/4K boundary like all others, and so is read separately to accurately calculate the size of the buffer needed to read the full IDAL. Verify that the address found in the first IDAW is unchanged between reads, to ensure a consistent set of IDAWs being worked with. Fixes: 01aa26c672c0 ("s390/cio: Combine direct and indirect CCW paths") Cc: stable@vger.kernel.org Reviewed-by: Matthew Rosato Signed-off-by: Eric Farman --- drivers/s390/cio/vfio_ccw_cp.c | 16 ++++++++++++++++ drivers/s390/cio/vfio_ccw_cp.h | 2 ++ 2 files changed, 18 insertions(+) diff --git a/drivers/s390/cio/vfio_ccw_cp.c b/drivers/s390/cio/vfio_ccw_c= p.c index af632f9d5453..6275794751cb 100644 --- a/drivers/s390/cio/vfio_ccw_cp.c +++ b/drivers/s390/cio/vfio_ccw_cp.c @@ -523,6 +523,7 @@ static dma64_t *get_guest_idal(struct ccw1 *ccw, stru= ct channel_program *cp, int &container_of(cp, struct vfio_ccw_private, cp)->vdev; dma64_t *idaws; dma32_t *idaws_f1; + u64 first_idaw; int idal_len =3D idaw_nr * sizeof(*idaws); int idaw_size =3D idal_is_2k(cp) ? PAGE_SIZE / 2 : PAGE_SIZE; int idaw_mask =3D ~(idaw_size - 1); @@ -539,6 +540,18 @@ static dma64_t *get_guest_idal(struct ccw1 *ccw, str= uct channel_program *cp, int kfree(idaws); return ERR_PTR(ret); } + + idaws_f1 =3D (dma32_t *)idaws; + if (cp->orb.cmd.c64) + first_idaw =3D dma64_to_u64(idaws[0]); + else + first_idaw =3D dma32_to_u32(idaws_f1[0]); + + /* Unexpected mismatch from earlier read */ + if (first_idaw !=3D cp->guest_iova) { + kfree(idaws); + return ERR_PTR(-EINVAL); + } } else { /* Fabricate an IDAL based off CCW data address */ if (cp->orb.cmd.c64) { @@ -604,6 +617,9 @@ static int ccw_count_idaws(struct ccw1 *ccw, iova =3D dma32_to_u32(ccw->cda); } =20 + /* Save the read address for later */ + cp->guest_iova =3D iova; + /* Format-1 IDAWs operate on 2K each */ if (!cp->orb.cmd.c64) return idal_2k_nr_words((void *)iova, bytes); diff --git a/drivers/s390/cio/vfio_ccw_cp.h b/drivers/s390/cio/vfio_ccw_c= p.h index a9b1d8dbc6f6..9af98ff12d67 100644 --- a/drivers/s390/cio/vfio_ccw_cp.h +++ b/drivers/s390/cio/vfio_ccw_cp.h @@ -35,6 +35,7 @@ * @initialized: whether this instance is actually initialized * @guest_cp: copy of guest channel program * @ccwchain_count: number of channel program segments (linked by TIC) + * @guest_iova: first data address of a guest channel program * * @ccwchain_list is the head of a ccwchain list, that contents the * translated result of the guest channel program that pointed out by @@ -46,6 +47,7 @@ struct channel_program { bool initialized; struct ccw1 *guest_cp; unsigned int ccwchain_count; + u64 guest_iova; }; =20 int cp_init(struct channel_program *cp, union orb *orb); --=20 2.53.0