Re: [PATCH v4 21/23] iommu/tegra241-cmdqv: Do not statically map LVCMDQs

Nicolin Chen
2025-05-15T17:03:42Z

On Thu, May 15, 2025 at 08:20:44AM +0000, Tian, Kevin wrote:
> > From: Nicolin Chen <nicolinc@nvidia.com>
> > Sent: Friday, May 9, 2025 11:03 AM
> >
> > To simplify the mappings from global VCMDQs to VINTFs' LVCMDQs, the
> > design
> > chose to do static allocations and mappings in the global reset function.
> >
> > However, with the user-owned VINTF support, it exposes a security concern:
> > if user space VM only wants one LVCMDQ for a VINTF, statically mapping two
> > or more LVCMDQs creates a hidden VCMDQ that user space could DoS attack
> > by
> > writing random stuff to overwhelm the kernel with unhandleable IRQs.
> >
> > Thus, to support the user-owned VINTF feature, a LVCMDQ mapping has to
> > be
> > done dynamically.
> >
> > HW allows pre-assigning global VCMDQs in the CMDQ_ALLOC registers,
> > without
> > finalizing the mappings by keeping CMDQV_CMDQ_ALLOCATED=0. So, add a
> > pair
> > of map/unmap helper that simply sets/clears that bit.
> >
> > Delay the LVCMDQ mappings to tegra241_vintf_hw_init(), and the
> > unmappings
> > to tegra241_vintf_hw_deinit().
>
> I don't know the specifics of tegra241-cmdqv. But the current description
> is a bit misleading. for native tegra241_vintf_hw_init() is called from reset
> so the mapping is still enabled in that path. for user-owned then
> tegra241_vcmdq_map_lvcmdq() is called from tegra241_vintf_alloc_lvcmdq_user()
> instead of tegra241_vintf_hw_init().
>
> so nothing is actually delayed in this patch.

It is delayed from tegra241_cmdqv_hw_reset() to later functions.

The in-kernel VINTF0 is not literally delayed fundamentally as
you mentioned because it needs to be allocated/mapped in probe().

The user-space VINTFs was previously allocated/mapped in probe(),
now it's moved to user space handler, i.e. no mapping until user
space asks for one.

Perhaps I can make this "delay" statement more narrative for a
clarification.

Thanks
Nicolin