Re: [PATCH 24/24] iommu/amd: Relocate vIOMMU translate-device-id on PCI reserve

[Suthikulpanit, Suravee]

On 8/19/2026 4:42 PM, guanghuifeng@xxxxxxxxxxxxxxxxx wrote:
> 在 2026/7/27 21:29, Suravee Suthikulpanit 写道:
> > When PCI attach reserves a BDF already allocated to a vIOMMU, relocate
> > that vIOMMU to a newly allocated translate-device-id before marking the
> > BDF reserved for the device.  Reprogram translation DTE and VFctrl under
> > trans_devid_lock; roll back the pool on failure.
> >
> > Signed-off-by: Suravee Suthikulpanit <suravee.suthikulpanit@xxxxxxx>
> > ---
> >   drivers/iommu/amd/trans_devid.c | 116 +++++++++++++++++++++++++++++++-
> >   1 file changed, 115 insertions(+), 1 deletion(-)
> >
> > diff --git a/drivers/iommu/amd/trans_devid.c b/drivers/iommu/amd/ 
> > trans_devid.c
> > index 9d7d93c5dcdb..6fb1ba3c9444 100644
> > --- a/drivers/iommu/amd/trans_devid.c
> > +++ b/drivers/iommu/amd/trans_devid.c
> > @@ -82,16 +82,120 @@ void amd_iommu_pci_seg_trans_devid_fini(struct 
> >
> > ....
> >
> > +static int trans_devid_relocate(struct amd_iommu_pci_seg *pci_seg, 
> > u16 from_id,
> > +                struct amd_iommu_viommu *aviommu)
> > +{
> > +    u16 new_id;
> > +    int ret;
> > +
> > +    mutex_lock(&aviommu->trans_devid_lock);
> > +
> > +    mutex_lock(&pci_seg->trans_devid_mutex);
> > +    if (trans_devid_xa_owner(xa_load(&pci_seg->trans_devid_xa, 
> > from_id)) !=
> > +        aviommu) {
> > +        ret = -ENOENT;
> > +        goto unlock_seg;
> > +    }
> > +
> > +    if (aviommu->trans_devid != from_id) {
> > +        ret = -EINVAL;
> > +        goto unlock_seg;
> > +    }
> > +
> > +    new_id = trans_devid_find_free_locked(pci_seg);
> > +    if (new_id < 0) {
> > +        ret = new_id;
> > +        goto unlock_seg;
> > +    }
>
>
> This has a type-truncation bug. trans_devid_find_free_locked() returns
> int and signals failure with -ENOSPC. Assigning it to a u16 truncates
> -ENOSPC (-28) to 65508 (0xFFDC), and the subsequent "if (new_id < 0)"
> is always false for an unsigned u16. On pool exhaustion the code would
> proceed to install and program a DTE with the bogus ID 65508. Please
> change new_id to int:
>
>      int new_id;

I'll fix in v5.

Thanks,
Suravee