linux-toradex.git/arch/powerpc, branch master

powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba

2026-09-16T08:13:58+00:00

The commit b1af23d836f8 ("KVM: PPC: iommu: Unify TCE checking") unified
IOBA parameter checking across KVM and VFIO into iommu_tce_check_ioba().
While doing so, the passed in argument npages is ignored and constant
value '1' is used leaving out a possible overflow as the callers can
legitimately be using npages > 1 for H_STUFF_TCE or H_PUT_TCE_INDIRECT
cases.

Fix this by accounting for 'npages', checking for arithmetic overflow,
and verifying that the entire requested range (ioba - offset + npages)
does not exceed the table capacity 'size'.

Fixes: b1af23d836f8 ("KVM: PPC: iommu: Unify TCE checking")
Reviewed-by: Ritesh Harjani (IBM) 
Tested-by: R Nageswara Sastry 
Signed-off-by: Shivaprasad G Bhat 
Signed-off-by: Gautam Menghani 
Signed-off-by: Madhavan Srinivasan

KVM: PPC: Book3S HV: fix secure device page leak on uv_page_in() failure

2026-09-16T08:13:54+00:00

In kvmppc_svm_page_in(), if uv_page_in() fails after
kvmppc_uvmem_get_page() has succeeded, the secure device page is never
released.  kvmppc_uvmem_get_page() sets a bit in kvmppc_uvmem_bitmap,
allocates a kvmppc_uvmem_page_pvt struct, marks the GFN as
KVMPPC_GFN_UVMEM_PFN, and calls zone_device_page_init() which sets
refcount=1 and locks the page.  The subsequent goto out_finalize skips
the *mig.dst assignment, so migrate_vma_finalize() is a no-op for the
page, and none of those resources are ever reclaimed.

Each occurrence permanently consumes one entry from the firmware-bounded
secure memory pool (kvmppc_uvmem_bitmap), leaks pvt, and leaves the GFN
marked as secure — making it unusable for the lifetime of the VM.

The twin __kvmppc_svm_page_out() already handles the analogous uv_page_out()
failure correctly with unlock_page(dpage); __free_page(dpage).  Apply
the same pattern here: unlock_page() followed by put_page(), which
chains through free_zone_device_folio() into kvmppc_uvmem_folio_free()
to clear the bitmap bit, free pvt, and reset the GFN state.

Reachable whenever uv_page_in() returns an error (e.g. UV pool
exhaustion) on any POWER9/10 + Ultravisor/PEF system.

Fixes: ca9f4942670c ("KVM: PPC: Book3S HV: Support for running secure guests")
Reviewed-by: Ritesh Harjani (IBM) 
Tested-by: R Nageswara Sastry 
Signed-off-by: Amit Machhiwal 
Signed-off-by: Gautam Menghani 
Signed-off-by: Madhavan Srinivasan

KVM: PPC: Book3S HV: fix use-after-free in kvmhv_emulate_tlbie_all_lpid()

2026-09-16T08:13:50+00:00

kvmhv_emulate_tlbie_all_lpid() iterates the nested-guest IDR and drops
mmu_lock before calling kvmhv_emulate_tlbie_lpid(), but does not hold a
reference on the kvm_nested_guest pointer obtained from the IDR.  A
concurrent vCPU issuing a single-LPID tlbie (is=2, ric=2) can race
through kvmhv_flush_nested() -> kvmhv_remove_nested() -> idr_remove /
--refcnt -> kvmhv_release_nested() -> kfree(gp) in that window, leaving
the iterating vCPU with a dangling pointer.  The subsequent
mutex_lock(&gp->tlb_lock) and accesses to gp->shadow_pgtable,
gp->shadow_lpid and gp->l1_host all touch freed memory.  The free path
is fully L1-controlled.

Fix this by incrementing gp->refcnt inside the loop before dropping
mmu_lock, mirroring what kvmhv_get_nested() does, and releasing the
reference with kvmhv_put_nested() after the per-guest work completes.
This is the same get/put discipline already used at every other
call site that drops mmu_lock while holding a nested-guest pointer.

Fixes: e3b6b4661527 ("KVM: PPC: Book3S HV: Implement H_TLB_INVALIDATE hcall")
Reviewed-by: Ritesh Harjani (IBM) 
Tested-by: R Nageswara Sastry 
Signed-off-by: Amit Machhiwal 
Signed-off-by: Gautam Menghani 
Signed-off-by: Madhavan Srinivasan

Merge tag 'powerpc-7.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux

2026-09-12T14:45:01+00:00

Pull powerpc fixes from Madhavan Srinivasan:

 - powerpc/entry: Fix double accounting of user time on interrupt entry

 - Fix leak in htmdump_init_debugfs

 - KVM: PPC: Book3S HV: Set irqfd->producer only on success

 - powerpc/kexec_file: print configured kernel command line

 - Remove redundant early_init_dt_scan_root() call

 - misc fixes and cleanup

Thanks to Aboorva Devarajan, Amit Machhiwal, Athira Rajeev, Christophe
Leroy, Christophe Leroy (CS GROUP), Kunwu Chan, leixiang, longlong yan,
Michail Tatas, Mukesh Kumar Chaurasiya (IBM), Ritesh Harjani (IBM),
Shivang Upadhyay, Sourabh Jain, Thibault Ferrante, Vaibhav Jain, and
Venkat Rao Bagalkote

* tag 'powerpc-7.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux:
  powerpc/pasemi: Add a null pointer check to the pas_setup_mce_regs
  powerpc/prom: Remove redundant early_init_dt_scan_root() call
  selftests/powerpc: use MAP_FAILED instead of (void *)-1 in tm-signal-context-force-tm
  powerpc/kexec_file: print configured kernel command line
  KVM: PPC: Book3S HV: Set irqfd->producer only on success
  powerpc/pseries/htmdump: Fix leak in htmdump_init_debugfs
  selftests/powerpc/tm: Fix tcheck() reading uninitialised CR value
  selftests/powerpc/pmu/ebb: fix lost_exception_test hang with sched yield change
  powerpc/entry: Fix double accounting of user time on interrupt entry

powerpc/pasemi: Add a null pointer check to the pas_setup_mce_regs

2026-09-10T07:49:25+00:00

kasprintf() returns a pointer to dynamically allocated memory
which can be NULL upon failure. Ensure the allocation was successful
by checking the pointer validity.

Signed-off-by: Kunwu Chan 
Reviewed-by: Christophe Leroy 
Signed-off-by: Madhavan Srinivasan 
Link: https://patch.msgid.link/20240117091706.153431-1-chentao@kylinos.cn

powerpc/prom: Remove redundant early_init_dt_scan_root() call

2026-09-10T07:47:53+00:00

Commit 554b66233623 ("of/fdt: Scan the root node properties earlier")
moved the invocation of early_init_dt_scan_root() into
early_init_dt_verify().

early_init_devtree() already calls early_init_dt_verify(), so the root
node properties are parsed before reaching the explicit call in this
function.

Keeping the call here results in scanning the root node twice. Remove
the redundant call and rely on the invocation from
early_init_dt_verify().

This change keeps the behavior the same and removes an unnecessary
duplicate call.

Signed-off-by: Sourabh Jain 
Tested-by: Shivang Upadhyay 
Reviewed-by: Ritesh Harjani (IBM) 
Signed-off-by: Madhavan Srinivasan 
Link: https://patch.msgid.link/20260418091250.134111-1-sourabhjain@linux.ibm.com

powerpc/kexec_file: print configured kernel command line

2026-09-10T07:45:26+00:00

Kexec with the -d option prints extra logs about the kexec/kdump kernel
that help debug kexec and kdump. For example, it shows what kexec
segments are loaded, their locations, and sizes.

One key piece of information still missing is the kernel command line
configured for the kexec/kdump kernel.

With this patch included, the kernel will print the kernel command line
configured for the kexec/kdump kernel as shown below:

kexec --initrd=./initrd ./kernel -lspd --command-line="test1 test2"

Loaded elf core header at 0x22e30000, bufsz=0x2000 memsz=0x80000
kexec_elf: Command line: elfcorehdr=0x22e30000 test1 test2   <--- New
kexec_elf: Loaded initrd at 0x22eb0000

Signed-off-by: Sourabh Jain 
Tested-by: Mukesh Kumar Chaurasiya (IBM) 
Reviewed-by: Mukesh Kumar Chaurasiya (IBM) 
Reviewed-by: Ritesh Harjani (IBM) 
Signed-off-by: Madhavan Srinivasan 
Link: https://patch.msgid.link/20250725124438.327593-1-sourabhjain@linux.ibm.com

KVM: PPC: Book3S HV: Set irqfd->producer only on success

2026-09-10T07:44:07+00:00

Set irqfd->producer only after kvmppc_set_passthru_irq() succeeds to
avoid leaving a dangling pointer on failure. The bypass manager does
not register a failed producer, so the pointer is never cleared.

Fixes: c57875f5f9be ("KVM: PPC: Book3S HV: Enable IRQ bypass")
Suggested-by: Sean Christopherson 
Cc: stable@vger.kernel.org
Signed-off-by: leixiang 
Reviewed-by: Amit Machhiwal 
Reviewed-by: Vaibhav Jain 
Signed-off-by: Madhavan Srinivasan 
Link: https://patch.msgid.link/20260709055755.31297-1-leixiang@kylinos.cn

powerpc/pseries/htmdump: Fix leak in htmdump_init_debugfs

2026-09-10T07:43:19+00:00

If any allocation fails during init all previous allocations are
leaked and the debugfs directory is left.
Fix by freeing the allocations that have already happened and also
remove the directory that has been created.

Signed-off-by: Michail Tatas 
Reviewed-by: Athira Rajeev 
Reviewed-by: Ritesh Harjani (IBM) 
Signed-off-by: Madhavan Srinivasan 
Link: https://patch.msgid.link/anJDq-JckR6j-6EJ@michalis-linux

powerpc/entry: Fix double accounting of user time on interrupt entry

2026-09-10T03:28:10+00:00

Since the switch to generic entry, an interrupt from user mode
accounts user time twice: once in arch_interrupt_enter_prepare()
and again in arch_enter_from_user_mode(), which irqentry_enter()
invokes for the same interrupt:

	arch_interrupt_enter_prepare()
	  account_cpu_user_entry()		/* first */
	irqentry_enter()
	  arch_enter_from_user_mode()
	    account_cpu_user_entry()		/* second */

The second call charges the same interval again, because
account_cpu_user_entry() accumulates the time spent in user mode
since the last return to user space.

The two calls come from the GENERIC_ENTRY preparation series,
where each step was a no-op on its own. Commit 09a9d3a8499d
("powerpc: introduce arch_enter_from_user_mode") added the hook
with the user-time accounting in it, but nothing called it yet.
Commit 893082ac769b ("powerpc: Prepare for IRQ entry exit")
copied interrupt_enter_prepare() verbatim into entry-common.h as
arch_interrupt_enter_prepare(); that copy was equally unused, as
handlers still called interrupt_enter_prepare().

Commit bee25f97ad24 ("powerpc: Enable GENERIC_ENTRY feature")
made both live. On the syscall side it did the full conversion:
system_call_exception() now accounts once through the hook via
syscall_enter_from_user_mode(), rather than calling
account_cpu_user_entry() directly. On the interrupt side it
switched the handler macros to arch_interrupt_enter_prepare()
followed by irqentry_enter(), which also runs the hook, but the
accounting in arch_interrupt_enter_prepare() was not removed to
match. The double accounting starts with that commit.

With CONFIG_VIRT_CPU_ACCOUNTING_NATIVE=y this roughly doubles the
reported user time of any workload that takes interrupts. The
other accounting modes compile account_cpu_user_entry() to an
empty stub, so they are not affected.

Remove the accounting from arch_interrupt_enter_prepare() and rely
on arch_enter_from_user_mode(), which already runs for both
syscalls and interrupts. The duplicate account_stolen_time() call
is removed the same way.

On a pseries LPAR a busy loop reports 6s user time in 3s elapsed
(~210% CPU) before the fix, and 3s (~105% CPU) after it:

  $ python3 -c 'while True: pass' &
  $ sleep 3; ps -p $! -o etime,time,pcpu

            ELAPSED     TIME  %CPU
  Before      00:03 00:00:06   210
  After       00:03 00:00:03   105

A 50% load reports ~70% usr / 30% idle before the fix, and
~49% usr / 51% idle after it:

  $ taskset -c 6 stress-ng --cpu 1 --cpu-load 50 &
  $ mpstat -P 6 1

            CPU    %usr   %idle
  Before      6   69.74   30.26
  After       6   48.51   50.50

Fixes: bee25f97ad24 ("powerpc: Enable GENERIC_ENTRY feature")
Reviewed-by: Mukesh Kumar Chaurasiya (IBM) 
Signed-off-by: Aboorva Devarajan 
Tested-by: Venkat Rao Bagalkote 
Reviewed-by: Amit Machhiwal 
Reviewed-by: Ritesh Harjani (IBM) 
Reviewed-by: Christophe Leroy (CS GROUP) 
Signed-off-by: Madhavan Srinivasan 
Link: https://patch.msgid.link/20260904025831.3439809-1-aboorvad@linux.ibm.com