Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [Critical] iommu: tegra SMMU isolation bypass for display controllers via defer_enable --
commit d4d42b6a74ebf50531a4c2f625710578bc863c34 Author: Mikko Perttunen <[email protected]> iommu/tegra-smmu: Defer display client translation to driver handover Bootloaders may leave display controllers scanning out a boot splash while the kernel boots. Enabling translation for them without special care during that time would cause translation faults. Because of this, tegra_smmu_def_domain_type has kept every device on an identity domain at boot, and TegraDRM has parallel custom IOMMU domain management code paths for these clients. > diff --git a/drivers/iommu/tegra-smmu.c b/drivers/iommu/tegra-smmu.c > index 67e7a7b925f0c..6779528a9e7cc 100644 > --- a/drivers/iommu/tegra-smmu.c > +++ b/drivers/iommu/tegra-smmu.c > @@ -368,7 +368,13 @@ static void tegra_smmu_enable(struct tegra_smmu *smmu, > unsigned int swgroup, > value = smmu_readl(smmu, group->reg); > value &= ~SMMU_ASID_MASK; > value |= SMMU_ASID_VALUE(asid); > - value |= SMMU_ASID_ENABLE; > + /* > + * A deferred client is set up completely, but with translation > + * gated off, so it stays in bypass until its driver calls > + * tegra_smmu_enable_translation(). > + */ > + if (!group->defer_enable) > + value |= SMMU_ASID_ENABLE; [Severity: Critical] If a generic driver like vfio-platform binds to this device (for example, to pass the display controller through to a VM), it attaches an unmanaged IOMMU domain and expects isolation to be enforced. Since tegra_smmu_enable() completes without setting SMMU_ASID_ENABLE for deferred clients, does this silently leave the hardware in bypass mode even after the IOMMU domain is successfully attached? This could allow an untrusted guest VM to program the DMA engine to read or write arbitrary host physical memory, bypassing IOMMU isolation. > smmu_writel(smmu, value, group->reg); > } else { > pr_warn("%s group from swgroup %u not found\n", __func__, -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=8
