Re: [PATCH v2 08/11] iommu/tegra-smmu: Defer display client translation to driver handover

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] iommu: tegra SMMU isolation bypass for display controllers via defer_enable
--

commit d4d42b6a74ebf50531a4c2f625710578bc863c34
Author: Mikko Perttunen <mperttunen@nvidia.com>

iommu/tegra-smmu: Defer display client translation to driver handover

Bootloaders may leave display controllers scanning out a boot splash
while the kernel boots. Enabling translation for them without special
care during that time would cause translation faults.

Because of this, tegra_smmu_def_domain_type has kept every device on an
identity domain at boot, and TegraDRM has parallel custom IOMMU domain
management code paths for these clients.

> diff --git a/drivers/iommu/tegra-smmu.c b/drivers/iommu/tegra-smmu.c
> index 67e7a7b925f0c..6779528a9e7cc 100644
> --- a/drivers/iommu/tegra-smmu.c
> +++ b/drivers/iommu/tegra-smmu.c
> @@ -368,7 +368,13 @@ static void tegra_smmu_enable(struct tegra_smmu *smmu, unsigned int swgroup,
>  		value = smmu_readl(smmu, group->reg);
>  		value &= ~SMMU_ASID_MASK;
>  		value |= SMMU_ASID_VALUE(asid);
> -		value |= SMMU_ASID_ENABLE;
> +		/*
> +		 * A deferred client is set up completely, but with translation
> +		 * gated off, so it stays in bypass until its driver calls
> +		 * tegra_smmu_enable_translation().
> +		 */
> +		if (!group->defer_enable)
> +			value |= SMMU_ASID_ENABLE;

[Severity: Critical]
If a generic driver like vfio-platform binds to this device (for example, to
pass the display controller through to a VM), it attaches an unmanaged IOMMU
domain and expects isolation to be enforced.

Since tegra_smmu_enable() completes without setting SMMU_ASID_ENABLE for
deferred clients, does this silently leave the hardware in bypass mode even
after the IOMMU domain is successfully attached?

This could allow an untrusted guest VM to program the DMA engine to read or
write arbitrary host physical memory, bypassing IOMMU isolation.

>  		smmu_writel(smmu, value, group->reg);
>  	} else {
>  		pr_warn("%s group from swgroup %u not found\n", __func__,

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261016-b4-arm32-iommu-dma-cookie-v2-0-b06842a01938@nvidia.com?part=8