All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH] iommu/rockchip: prevent iommus dead loop when two masters share one IOMMU
@ 2025-06-20  7:39 ` Simon Xue
  0 siblings, 0 replies; 13+ messages in thread
From: Simon Xue @ 2025-06-20  7:39 UTC (permalink / raw)
  To: joro, will, heiko
  Cc: robin.murphy, iommu, linux-arm-kernel, linux-rockchip,
	linux-kernel, Simon Xue

When two masters share an IOMMU, calling ops->of_xlate during
the second master's driver init may overwrite iommu->domain set
by the first. This causes the check if (iommu->domain == domain)
in rk_iommu_attach_device() to fail, resulting in the same
iommu->node being added twice to &rk_domain->iommus, which can
lead to an infinite loop in subsequent &rk_domain->iommus operations.

Signed-off-by: Simon Xue <xxm@rock-chips.com>
---
 drivers/iommu/rockchip-iommu.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/iommu/rockchip-iommu.c b/drivers/iommu/rockchip-iommu.c
index 22f74ba33a0e..e6bb3c784017 100644
--- a/drivers/iommu/rockchip-iommu.c
+++ b/drivers/iommu/rockchip-iommu.c
@@ -1157,7 +1157,6 @@ static int rk_iommu_of_xlate(struct device *dev,
 		return -ENOMEM;
 
 	data->iommu = platform_get_drvdata(iommu_dev);
-	data->iommu->domain = &rk_identity_domain;
 	dev_iommu_priv_set(dev, data);
 
 	platform_device_put(iommu_dev);
@@ -1195,6 +1194,8 @@ static int rk_iommu_probe(struct platform_device *pdev)
 	if (!iommu)
 		return -ENOMEM;
 
+	iommu->domain = &rk_identity_domain;
+
 	platform_set_drvdata(pdev, iommu);
 	iommu->dev = dev;
 	iommu->num_mmu = 0;
-- 
2.34.1



^ permalink raw reply related	[flat|nested] 13+ messages in thread

* [PATCH] iommu/rockchip: prevent iommus dead loop when two masters share one IOMMU
@ 2025-06-20  7:39 ` Simon Xue
  0 siblings, 0 replies; 13+ messages in thread
From: Simon Xue @ 2025-06-20  7:39 UTC (permalink / raw)
  To: joro, will, heiko
  Cc: robin.murphy, iommu, linux-arm-kernel, linux-rockchip,
	linux-kernel, Simon Xue

When two masters share an IOMMU, calling ops->of_xlate during
the second master's driver init may overwrite iommu->domain set
by the first. This causes the check if (iommu->domain == domain)
in rk_iommu_attach_device() to fail, resulting in the same
iommu->node being added twice to &rk_domain->iommus, which can
lead to an infinite loop in subsequent &rk_domain->iommus operations.

Signed-off-by: Simon Xue <xxm@rock-chips.com>
---
 drivers/iommu/rockchip-iommu.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/iommu/rockchip-iommu.c b/drivers/iommu/rockchip-iommu.c
index 22f74ba33a0e..e6bb3c784017 100644
--- a/drivers/iommu/rockchip-iommu.c
+++ b/drivers/iommu/rockchip-iommu.c
@@ -1157,7 +1157,6 @@ static int rk_iommu_of_xlate(struct device *dev,
 		return -ENOMEM;
 
 	data->iommu = platform_get_drvdata(iommu_dev);
-	data->iommu->domain = &rk_identity_domain;
 	dev_iommu_priv_set(dev, data);
 
 	platform_device_put(iommu_dev);
@@ -1195,6 +1194,8 @@ static int rk_iommu_probe(struct platform_device *pdev)
 	if (!iommu)
 		return -ENOMEM;
 
+	iommu->domain = &rk_identity_domain;
+
 	platform_set_drvdata(pdev, iommu);
 	iommu->dev = dev;
 	iommu->num_mmu = 0;
-- 
2.34.1


_______________________________________________
Linux-rockchip mailing list
Linux-rockchip@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-rockchip

^ permalink raw reply related	[flat|nested] 13+ messages in thread

* Re: [PATCH] iommu/rockchip: prevent iommus dead loop when two masters share one IOMMU
  2025-06-20  7:39 ` Simon Xue
@ 2025-06-20 11:19   ` Robin Murphy
  -1 siblings, 0 replies; 13+ messages in thread
From: Robin Murphy @ 2025-06-20 11:19 UTC (permalink / raw)
  To: Simon Xue, joro, will, heiko
  Cc: iommu, linux-arm-kernel, linux-rockchip, linux-kernel

On 2025-06-20 8:39 am, Simon Xue wrote:
> When two masters share an IOMMU, calling ops->of_xlate during
> the second master's driver init may overwrite iommu->domain set
> by the first. This causes the check if (iommu->domain == domain)
> in rk_iommu_attach_device() to fail, resulting in the same
> iommu->node being added twice to &rk_domain->iommus, which can
> lead to an infinite loop in subsequent &rk_domain->iommus operations.

Indeed this is a property of the IOMMU instance itself so it really 
should be initialised before registration, irrespective of client 
devices. FWIW, if it's possible to take an unexpected 
RK_MMU_IRQ_PAGE_FAULT immediately after requesting the IRQ (e.g. in a 
kdump kernel after a crash with the hardware still running) then I think 
the current code could probably end up dereferencing NULL in 
report_iommu_fault() as well.

Reviewed-by: Robin Murphy <robin.murphy@arm.com>

And probably also:

Cc: stable@vger.kernel.org
Fixes: 25c2325575cc ("iommu/rockchip: Add missing set_platform_dma_ops 
callback")

Thanks,
Robin.

> Signed-off-by: Simon Xue <xxm@rock-chips.com>
> ---
>   drivers/iommu/rockchip-iommu.c | 3 ++-
>   1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/iommu/rockchip-iommu.c b/drivers/iommu/rockchip-iommu.c
> index 22f74ba33a0e..e6bb3c784017 100644
> --- a/drivers/iommu/rockchip-iommu.c
> +++ b/drivers/iommu/rockchip-iommu.c
> @@ -1157,7 +1157,6 @@ static int rk_iommu_of_xlate(struct device *dev,
>   		return -ENOMEM;
>   
>   	data->iommu = platform_get_drvdata(iommu_dev);
> -	data->iommu->domain = &rk_identity_domain;
>   	dev_iommu_priv_set(dev, data);
>   
>   	platform_device_put(iommu_dev);
> @@ -1195,6 +1194,8 @@ static int rk_iommu_probe(struct platform_device *pdev)
>   	if (!iommu)
>   		return -ENOMEM;
>   
> +	iommu->domain = &rk_identity_domain;
> +
>   	platform_set_drvdata(pdev, iommu);
>   	iommu->dev = dev;
>   	iommu->num_mmu = 0;



^ permalink raw reply	[flat|nested] 13+ messages in thread

* Re: [PATCH] iommu/rockchip: prevent iommus dead loop when two masters share one IOMMU
@ 2025-06-20 11:19   ` Robin Murphy
  0 siblings, 0 replies; 13+ messages in thread
From: Robin Murphy @ 2025-06-20 11:19 UTC (permalink / raw)
  To: Simon Xue, joro, will, heiko
  Cc: iommu, linux-arm-kernel, linux-rockchip, linux-kernel

On 2025-06-20 8:39 am, Simon Xue wrote:
> When two masters share an IOMMU, calling ops->of_xlate during
> the second master's driver init may overwrite iommu->domain set
> by the first. This causes the check if (iommu->domain == domain)
> in rk_iommu_attach_device() to fail, resulting in the same
> iommu->node being added twice to &rk_domain->iommus, which can
> lead to an infinite loop in subsequent &rk_domain->iommus operations.

Indeed this is a property of the IOMMU instance itself so it really 
should be initialised before registration, irrespective of client 
devices. FWIW, if it's possible to take an unexpected 
RK_MMU_IRQ_PAGE_FAULT immediately after requesting the IRQ (e.g. in a 
kdump kernel after a crash with the hardware still running) then I think 
the current code could probably end up dereferencing NULL in 
report_iommu_fault() as well.

Reviewed-by: Robin Murphy <robin.murphy@arm.com>

And probably also:

Cc: stable@vger.kernel.org
Fixes: 25c2325575cc ("iommu/rockchip: Add missing set_platform_dma_ops 
callback")

Thanks,
Robin.

> Signed-off-by: Simon Xue <xxm@rock-chips.com>
> ---
>   drivers/iommu/rockchip-iommu.c | 3 ++-
>   1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/iommu/rockchip-iommu.c b/drivers/iommu/rockchip-iommu.c
> index 22f74ba33a0e..e6bb3c784017 100644
> --- a/drivers/iommu/rockchip-iommu.c
> +++ b/drivers/iommu/rockchip-iommu.c
> @@ -1157,7 +1157,6 @@ static int rk_iommu_of_xlate(struct device *dev,
>   		return -ENOMEM;
>   
>   	data->iommu = platform_get_drvdata(iommu_dev);
> -	data->iommu->domain = &rk_identity_domain;
>   	dev_iommu_priv_set(dev, data);
>   
>   	platform_device_put(iommu_dev);
> @@ -1195,6 +1194,8 @@ static int rk_iommu_probe(struct platform_device *pdev)
>   	if (!iommu)
>   		return -ENOMEM;
>   
> +	iommu->domain = &rk_identity_domain;
> +
>   	platform_set_drvdata(pdev, iommu);
>   	iommu->dev = dev;
>   	iommu->num_mmu = 0;


_______________________________________________
Linux-rockchip mailing list
Linux-rockchip@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-rockchip

^ permalink raw reply	[flat|nested] 13+ messages in thread

* 回复: Re: [PATCH] iommu/rockchip: prevent iommus dead loop when two masters share one IOMMU
  2025-06-20 11:19   ` Robin Murphy
@ 2025-06-23  0:41     ` xxm
  -1 siblings, 0 replies; 13+ messages in thread
From: xxm @ 2025-06-23  0:41 UTC (permalink / raw)
  To: robin.murphy, joro, will, heiko
  Cc: iommu, linux-arm-kernel, linux-rockchip, linux-kernel

Hi Robin,


>On 2025-06-20 8:39 am, Simon Xue wrote:



>> When two masters share an IOMMU, calling ops->of_xlate during



>> the second master's driver init may overwrite iommu->domain set



>> by the first. This causes the check if (iommu->domain == domain)



>> in rk_iommu_attach_device() to fail, resulting in the same



>> iommu->node being added twice to &rk_domain->iommus, which can



>> lead to an infinite loop in subsequent &rk_domain->iommus operations.



>



>Indeed this is a property of the IOMMU instance itself so it really 



>should be initialised before registration, irrespective of client 



>devices. FWIW, if it's possible to take an unexpected 



>RK_MMU_IRQ_PAGE_FAULT immediately after requesting the IRQ (e.g. in a 



>kdump kernel after a crash with the hardware still running) then I think 



>the current code could probably end up dereferencing NULL in 



>report_iommu_fault() as well.


Thanks  for your review and clear explanation, I will add the information as you suggested.

Simon Xue

>



>Reviewed-by: Robin Murphy <robin.murphy@arm.com>



>



>And probably also:



>



>Cc: stable@vger.kernel.org



>Fixes: 25c2325575cc ("iommu/rockchip: Add missing set_platform_dma_ops 



>callback")



>



>Thanks,



>Robin.



>



>> Signed-off-by: Simon Xue <xxm@rock-chips.com>



>> ---



>>   drivers/iommu/rockchip-iommu.c | 3 ++-



>>   1 file changed, 2 insertions(+), 1 deletion(-)



>> 



>> diff --git a/drivers/iommu/rockchip-iommu.c b/drivers/iommu/rockchip-iommu.c



>> index 22f74ba33a0e..e6bb3c784017 100644



>> --- a/drivers/iommu/rockchip-iommu.c



>> +++ b/drivers/iommu/rockchip-iommu.c



>> @@ -1157,7 +1157,6 @@ static int rk_iommu_of_xlate(struct device *dev,



>>   		return -ENOMEM;



>>   



>>   	data->iommu = platform_get_drvdata(iommu_dev);



>> -	data->iommu->domain = &rk_identity_domain;



>>   	dev_iommu_priv_set(dev, data);



>>   



>>   	platform_device_put(iommu_dev);



>> @@ -1195,6 +1194,8 @@ static int rk_iommu_probe(struct platform_device *pdev)



>>   	if (!iommu)



>>   		return -ENOMEM;



>>   



>> +	iommu->domain = &rk_identity_domain;



>> +



>>   	platform_set_drvdata(pdev, iommu);



>>   	iommu->dev = dev;



>>   	iommu->num_mmu = 0;



>



>



^ permalink raw reply	[flat|nested] 13+ messages in thread

* 回复: Re: [PATCH] iommu/rockchip: prevent iommus dead loop when two masters share one IOMMU
@ 2025-06-23  0:41     ` xxm
  0 siblings, 0 replies; 13+ messages in thread
From: xxm @ 2025-06-23  0:41 UTC (permalink / raw)
  To: robin.murphy, joro, will, heiko
  Cc: iommu, linux-arm-kernel, linux-rockchip, linux-kernel

Hi Robin,


>On 2025-06-20 8:39 am, Simon Xue wrote:



>> When two masters share an IOMMU, calling ops->of_xlate during



>> the second master's driver init may overwrite iommu->domain set



>> by the first. This causes the check if (iommu->domain == domain)



>> in rk_iommu_attach_device() to fail, resulting in the same



>> iommu->node being added twice to &rk_domain->iommus, which can



>> lead to an infinite loop in subsequent &rk_domain->iommus operations.



>



>Indeed this is a property of the IOMMU instance itself so it really 



>should be initialised before registration, irrespective of client 



>devices. FWIW, if it's possible to take an unexpected 



>RK_MMU_IRQ_PAGE_FAULT immediately after requesting the IRQ (e.g. in a 



>kdump kernel after a crash with the hardware still running) then I think 



>the current code could probably end up dereferencing NULL in 



>report_iommu_fault() as well.


Thanks  for your review and clear explanation, I will add the information as you suggested.

Simon Xue

>



>Reviewed-by: Robin Murphy <robin.murphy@arm.com>



>



>And probably also:



>



>Cc: stable@vger.kernel.org



>Fixes: 25c2325575cc ("iommu/rockchip: Add missing set_platform_dma_ops 



>callback")



>



>Thanks,



>Robin.



>



>> Signed-off-by: Simon Xue <xxm@rock-chips.com>



>> ---



>>   drivers/iommu/rockchip-iommu.c | 3 ++-



>>   1 file changed, 2 insertions(+), 1 deletion(-)



>> 



>> diff --git a/drivers/iommu/rockchip-iommu.c b/drivers/iommu/rockchip-iommu.c



>> index 22f74ba33a0e..e6bb3c784017 100644



>> --- a/drivers/iommu/rockchip-iommu.c



>> +++ b/drivers/iommu/rockchip-iommu.c



>> @@ -1157,7 +1157,6 @@ static int rk_iommu_of_xlate(struct device *dev,



>>   		return -ENOMEM;



>>   



>>   	data->iommu = platform_get_drvdata(iommu_dev);



>> -	data->iommu->domain = &rk_identity_domain;



>>   	dev_iommu_priv_set(dev, data);



>>   



>>   	platform_device_put(iommu_dev);



>> @@ -1195,6 +1194,8 @@ static int rk_iommu_probe(struct platform_device *pdev)



>>   	if (!iommu)



>>   		return -ENOMEM;



>>   



>> +	iommu->domain = &rk_identity_domain;



>> +



>>   	platform_set_drvdata(pdev, iommu);



>>   	iommu->dev = dev;



>>   	iommu->num_mmu = 0;



>



>


_______________________________________________
Linux-rockchip mailing list
Linux-rockchip@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-rockchip

^ permalink raw reply	[flat|nested] 13+ messages in thread

* [PATCH v2] iommu/rockchip: prevent iommus dead loop when two masters share one IOMMU
  2025-06-20  7:39 ` Simon Xue
@ 2025-06-23  1:05   ` Simon Xue
  -1 siblings, 0 replies; 13+ messages in thread
From: Simon Xue @ 2025-06-23  1:05 UTC (permalink / raw)
  To: joro, will, heiko
  Cc: robin.murphy, iommu, linux-arm-kernel, linux-rockchip,
	linux-kernel, stable, Simon Xue

When two masters share an IOMMU, calling ops->of_xlate during
the second master's driver init may overwrite iommu->domain set
by the first. This causes the check if (iommu->domain == domain)
in rk_iommu_attach_device() to fail, resulting in the same
iommu->node being added twice to &rk_domain->iommus, which can
lead to an infinite loop in subsequent &rk_domain->iommus operations.

Fixes: 25c2325575cc ("iommu/rockchip: Add missing set_platform_dma_ops callback")

Signed-off-by: Simon Xue <xxm@rock-chips.com>
Reviewed-by: Robin Murphy <robin.murphy@arm.com>

v2:
   No functional changes.
---
 drivers/iommu/rockchip-iommu.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/iommu/rockchip-iommu.c b/drivers/iommu/rockchip-iommu.c
index 22f74ba33a0e..e6bb3c784017 100644
--- a/drivers/iommu/rockchip-iommu.c
+++ b/drivers/iommu/rockchip-iommu.c
@@ -1157,7 +1157,6 @@ static int rk_iommu_of_xlate(struct device *dev,
 		return -ENOMEM;
 
 	data->iommu = platform_get_drvdata(iommu_dev);
-	data->iommu->domain = &rk_identity_domain;
 	dev_iommu_priv_set(dev, data);
 
 	platform_device_put(iommu_dev);
@@ -1195,6 +1194,8 @@ static int rk_iommu_probe(struct platform_device *pdev)
 	if (!iommu)
 		return -ENOMEM;
 
+	iommu->domain = &rk_identity_domain;
+
 	platform_set_drvdata(pdev, iommu);
 	iommu->dev = dev;
 	iommu->num_mmu = 0;
-- 
2.34.1



^ permalink raw reply related	[flat|nested] 13+ messages in thread

* [PATCH v2] iommu/rockchip: prevent iommus dead loop when two masters share one IOMMU
@ 2025-06-23  1:05   ` Simon Xue
  0 siblings, 0 replies; 13+ messages in thread
From: Simon Xue @ 2025-06-23  1:05 UTC (permalink / raw)
  To: joro, will, heiko
  Cc: robin.murphy, iommu, linux-arm-kernel, linux-rockchip,
	linux-kernel, stable, Simon Xue

When two masters share an IOMMU, calling ops->of_xlate during
the second master's driver init may overwrite iommu->domain set
by the first. This causes the check if (iommu->domain == domain)
in rk_iommu_attach_device() to fail, resulting in the same
iommu->node being added twice to &rk_domain->iommus, which can
lead to an infinite loop in subsequent &rk_domain->iommus operations.

Fixes: 25c2325575cc ("iommu/rockchip: Add missing set_platform_dma_ops callback")

Signed-off-by: Simon Xue <xxm@rock-chips.com>
Reviewed-by: Robin Murphy <robin.murphy@arm.com>

v2:
   No functional changes.
---
 drivers/iommu/rockchip-iommu.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/iommu/rockchip-iommu.c b/drivers/iommu/rockchip-iommu.c
index 22f74ba33a0e..e6bb3c784017 100644
--- a/drivers/iommu/rockchip-iommu.c
+++ b/drivers/iommu/rockchip-iommu.c
@@ -1157,7 +1157,6 @@ static int rk_iommu_of_xlate(struct device *dev,
 		return -ENOMEM;
 
 	data->iommu = platform_get_drvdata(iommu_dev);
-	data->iommu->domain = &rk_identity_domain;
 	dev_iommu_priv_set(dev, data);
 
 	platform_device_put(iommu_dev);
@@ -1195,6 +1194,8 @@ static int rk_iommu_probe(struct platform_device *pdev)
 	if (!iommu)
 		return -ENOMEM;
 
+	iommu->domain = &rk_identity_domain;
+
 	platform_set_drvdata(pdev, iommu);
 	iommu->dev = dev;
 	iommu->num_mmu = 0;
-- 
2.34.1


_______________________________________________
Linux-rockchip mailing list
Linux-rockchip@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-rockchip

^ permalink raw reply related	[flat|nested] 13+ messages in thread

* Re: [PATCH v2] iommu/rockchip: prevent iommus dead loop when two masters share one IOMMU
  2025-06-23  1:05   ` Simon Xue
  (?)
@ 2025-06-23  1:12   ` kernel test robot
  -1 siblings, 0 replies; 13+ messages in thread
From: kernel test robot @ 2025-06-23  1:12 UTC (permalink / raw)
  To: Simon Xue; +Cc: stable, oe-kbuild-all

Hi,

Thanks for your patch.

FYI: kernel test robot notices the stable kernel rule is not satisfied.

The check is based on https://www.kernel.org/doc/html/latest/process/stable-kernel-rules.html#option-1

Rule: add the tag "Cc: stable@vger.kernel.org" in the sign-off area to have the patch automatically included in the stable tree.
Subject: [PATCH v2] iommu/rockchip: prevent iommus dead loop when two masters share one IOMMU
Link: https://lore.kernel.org/stable/20250623010532.584409-1-xxm%40rock-chips.com

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki




^ permalink raw reply	[flat|nested] 13+ messages in thread

* [PATCH v3] iommu/rockchip: prevent iommus dead loop when two masters share one IOMMU
  2025-06-23  1:05   ` Simon Xue
@ 2025-06-23  2:00     ` Simon Xue
  -1 siblings, 0 replies; 13+ messages in thread
From: Simon Xue @ 2025-06-23  2:00 UTC (permalink / raw)
  To: joro, will, heiko
  Cc: robin.murphy, iommu, linux-arm-kernel, linux-rockchip,
	linux-kernel, stable, Simon Xue

When two masters share an IOMMU, calling ops->of_xlate during
the second master's driver init may overwrite iommu->domain set
by the first. This causes the check if (iommu->domain == domain)
in rk_iommu_attach_device() to fail, resulting in the same
iommu->node being added twice to &rk_domain->iommus, which can
lead to an infinite loop in subsequent &rk_domain->iommus operations.

Cc: <stable@vger.kernel.org>
Fixes: 25c2325575cc ("iommu/rockchip: Add missing set_platform_dma_ops callback")
Signed-off-by: Simon Xue <xxm@rock-chips.com>
Reviewed-by: Robin Murphy <robin.murphy@arm.com>

v3:
   Add missing `Cc: stable@vger.kernel.org` in commit message.
   No functional changes.
v2:
   No functional changes.
---
 drivers/iommu/rockchip-iommu.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/iommu/rockchip-iommu.c b/drivers/iommu/rockchip-iommu.c
index 22f74ba33a0e..e6bb3c784017 100644
--- a/drivers/iommu/rockchip-iommu.c
+++ b/drivers/iommu/rockchip-iommu.c
@@ -1157,7 +1157,6 @@ static int rk_iommu_of_xlate(struct device *dev,
 		return -ENOMEM;
 
 	data->iommu = platform_get_drvdata(iommu_dev);
-	data->iommu->domain = &rk_identity_domain;
 	dev_iommu_priv_set(dev, data);
 
 	platform_device_put(iommu_dev);
@@ -1195,6 +1194,8 @@ static int rk_iommu_probe(struct platform_device *pdev)
 	if (!iommu)
 		return -ENOMEM;
 
+	iommu->domain = &rk_identity_domain;
+
 	platform_set_drvdata(pdev, iommu);
 	iommu->dev = dev;
 	iommu->num_mmu = 0;
-- 
2.34.1



^ permalink raw reply related	[flat|nested] 13+ messages in thread

* [PATCH v3] iommu/rockchip: prevent iommus dead loop when two masters share one IOMMU
@ 2025-06-23  2:00     ` Simon Xue
  0 siblings, 0 replies; 13+ messages in thread
From: Simon Xue @ 2025-06-23  2:00 UTC (permalink / raw)
  To: joro, will, heiko
  Cc: robin.murphy, iommu, linux-arm-kernel, linux-rockchip,
	linux-kernel, stable, Simon Xue

When two masters share an IOMMU, calling ops->of_xlate during
the second master's driver init may overwrite iommu->domain set
by the first. This causes the check if (iommu->domain == domain)
in rk_iommu_attach_device() to fail, resulting in the same
iommu->node being added twice to &rk_domain->iommus, which can
lead to an infinite loop in subsequent &rk_domain->iommus operations.

Cc: <stable@vger.kernel.org>
Fixes: 25c2325575cc ("iommu/rockchip: Add missing set_platform_dma_ops callback")
Signed-off-by: Simon Xue <xxm@rock-chips.com>
Reviewed-by: Robin Murphy <robin.murphy@arm.com>

v3:
   Add missing `Cc: stable@vger.kernel.org` in commit message.
   No functional changes.
v2:
   No functional changes.
---
 drivers/iommu/rockchip-iommu.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/iommu/rockchip-iommu.c b/drivers/iommu/rockchip-iommu.c
index 22f74ba33a0e..e6bb3c784017 100644
--- a/drivers/iommu/rockchip-iommu.c
+++ b/drivers/iommu/rockchip-iommu.c
@@ -1157,7 +1157,6 @@ static int rk_iommu_of_xlate(struct device *dev,
 		return -ENOMEM;
 
 	data->iommu = platform_get_drvdata(iommu_dev);
-	data->iommu->domain = &rk_identity_domain;
 	dev_iommu_priv_set(dev, data);
 
 	platform_device_put(iommu_dev);
@@ -1195,6 +1194,8 @@ static int rk_iommu_probe(struct platform_device *pdev)
 	if (!iommu)
 		return -ENOMEM;
 
+	iommu->domain = &rk_identity_domain;
+
 	platform_set_drvdata(pdev, iommu);
 	iommu->dev = dev;
 	iommu->num_mmu = 0;
-- 
2.34.1


_______________________________________________
Linux-rockchip mailing list
Linux-rockchip@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-rockchip

^ permalink raw reply related	[flat|nested] 13+ messages in thread

* Re: [PATCH v3] iommu/rockchip: prevent iommus dead loop when two masters share one IOMMU
  2025-06-23  2:00     ` Simon Xue
@ 2025-06-27  7:12       ` Joerg Roedel
  -1 siblings, 0 replies; 13+ messages in thread
From: Joerg Roedel @ 2025-06-27  7:12 UTC (permalink / raw)
  To: Simon Xue
  Cc: will, heiko, robin.murphy, iommu, linux-arm-kernel,
	linux-rockchip, linux-kernel, stable

On Mon, Jun 23, 2025 at 10:00:18AM +0800, Simon Xue wrote:
> When two masters share an IOMMU, calling ops->of_xlate during
> the second master's driver init may overwrite iommu->domain set
> by the first. This causes the check if (iommu->domain == domain)
> in rk_iommu_attach_device() to fail, resulting in the same
> iommu->node being added twice to &rk_domain->iommus, which can
> lead to an infinite loop in subsequent &rk_domain->iommus operations.
> 
> Cc: <stable@vger.kernel.org>
> Fixes: 25c2325575cc ("iommu/rockchip: Add missing set_platform_dma_ops callback")
> Signed-off-by: Simon Xue <xxm@rock-chips.com>
> Reviewed-by: Robin Murphy <robin.murphy@arm.com>
> 
> v3:
>    Add missing `Cc: stable@vger.kernel.org` in commit message.
>    No functional changes.
> v2:
>    No functional changes.
> ---
>  drivers/iommu/rockchip-iommu.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)

Applied for -rc, thanks.


^ permalink raw reply	[flat|nested] 13+ messages in thread

* Re: [PATCH v3] iommu/rockchip: prevent iommus dead loop when two masters share one IOMMU
@ 2025-06-27  7:12       ` Joerg Roedel
  0 siblings, 0 replies; 13+ messages in thread
From: Joerg Roedel @ 2025-06-27  7:12 UTC (permalink / raw)
  To: Simon Xue
  Cc: will, heiko, robin.murphy, iommu, linux-arm-kernel,
	linux-rockchip, linux-kernel, stable

On Mon, Jun 23, 2025 at 10:00:18AM +0800, Simon Xue wrote:
> When two masters share an IOMMU, calling ops->of_xlate during
> the second master's driver init may overwrite iommu->domain set
> by the first. This causes the check if (iommu->domain == domain)
> in rk_iommu_attach_device() to fail, resulting in the same
> iommu->node being added twice to &rk_domain->iommus, which can
> lead to an infinite loop in subsequent &rk_domain->iommus operations.
> 
> Cc: <stable@vger.kernel.org>
> Fixes: 25c2325575cc ("iommu/rockchip: Add missing set_platform_dma_ops callback")
> Signed-off-by: Simon Xue <xxm@rock-chips.com>
> Reviewed-by: Robin Murphy <robin.murphy@arm.com>
> 
> v3:
>    Add missing `Cc: stable@vger.kernel.org` in commit message.
>    No functional changes.
> v2:
>    No functional changes.
> ---
>  drivers/iommu/rockchip-iommu.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)

Applied for -rc, thanks.

_______________________________________________
Linux-rockchip mailing list
Linux-rockchip@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-rockchip

^ permalink raw reply	[flat|nested] 13+ messages in thread

end of thread, other threads:[~2025-11-06 12:28 UTC | newest]

Thread overview: 13+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-06-20  7:39 [PATCH] iommu/rockchip: prevent iommus dead loop when two masters share one IOMMU Simon Xue
2025-06-20  7:39 ` Simon Xue
2025-06-20 11:19 ` Robin Murphy
2025-06-20 11:19   ` Robin Murphy
2025-06-23  0:41   ` 回复: " xxm
2025-06-23  0:41     ` xxm
2025-06-23  1:05 ` [PATCH v2] " Simon Xue
2025-06-23  1:05   ` Simon Xue
2025-06-23  1:12   ` kernel test robot
2025-06-23  2:00   ` [PATCH v3] " Simon Xue
2025-06-23  2:00     ` Simon Xue
2025-06-27  7:12     ` Joerg Roedel
2025-06-27  7:12       ` Joerg Roedel

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.