Re: [PATCH v3 3/5] iommu/generic_pt: Add Broadcom BCM2712 page table format

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Silent truncation of the page table physical address if allocated above the 37-bit limit.
--

commit d58086891d7da9b612c9b0e4a88de9a9dc4f255e
Author: Daniel Drake <dan@reactivated.net>

iommu/generic_pt: Add Broadcom BCM2712 page table format

Implement generic_pt support for the 2-level page table format used by
the BCM2712 IOMMUs.

> diff --git a/drivers/iommu/generic_pt/fmt/bcm2712.h b/drivers/iommu/generic_pt/fmt/bcm2712.h
> new file mode 100644
> index 0000000000000..2c5b034441c14
> --- /dev/null
> +++ b/drivers/iommu/generic_pt/fmt/bcm2712.h
> @@ -0,0 +1,288 @@

[ ... ]

> +static inline bool bcm2712pt_install_table(struct pt_state *pts,
> +					   pt_oaddr_t table_pa,
> +					   const struct pt_write_attrs *attrs)
> +{
> +	pt_bcm2712_entry_t entry =
> +		BCM2712PT_VALID |
> +		FIELD_PREP(BCM2712PT_PFN,
> +			   oalog2_div(table_pa, PT_GRANULE_LG2SZ));
> +
> +	return pt_table_install32(pts, entry);
> +}

[Severity: High]
Can table_pa exceed the 37-bit physical address limit here?

Because GFP_KERNEL is used when allocating child tables, the memory
allocations are not restricted to 32-bit or 37-bit physical addresses.

While the BCM2712 hardware might currently not exceed 16GB of RAM, the
generic_pt KUnit test for this format can run on any architecture. On systems
with >128GB of RAM, couldn't the child table memory be allocated above the
37-bit boundary?

If so, wouldn't FIELD_PREP() silently truncate the upper bits of table_pa
since BCM2712PT_PFN is only 25 bits?

Could this cause the IOMMU hardware to access truncated physical addresses,
reading random memory and leading to spurious test failures, faults, or DMA
memory corruption?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260825-bcm2712-iommu-submit-v3-0-7f143e7289b6@reactivated.net?part=3