[PATCH v2 20/22] iommu/tegra241-cmdqv: Do not statically map LVCMDQs

[Nicolin Chen]

On Tue, Apr 29, 2025 at 10:32:19PM +0000, Pranjal Shrivastava wrote:
> On Fri, Apr 25, 2025 at 10:58:15PM -0700, Nicolin Chen wrote:
> > To simplify the mappings from global VCMDQs to VINTFs' LVCMDQs, the design
> > chose to do static allocations and mappings in the global reset function.
> > 
> > However, with the user-owned VINTF support, it exposes a security concern:
> > if user space VM only wants one LVCMDQ for a VINTF, statically mapping two
> > LVCMDQs creates a hidden VCMDQ that user space could DoS attack by writing
> > ramdon stuff to overwhelm the kernel with unhandleable IRQs.
> > 
> 
> Nit: I think it's worth mentioning that the current HW only supports 2
> LVCMDQs. Since it's not clear from the driver as it calculates this by:
> 
>         regval = readl_relaxed(REG_CMDQV(cmdqv, PARAM));
>         cmdqv->num_vintfs = 1 << FIELD_GET(CMDQV_NUM_VINTF_LOG2,regval);
>         cmdqv->num_vcmdqs = 1 << FIELD_GET(CMDQV_NUM_VCMDQ_LOG2, regval);
> 	cmdqv->num_lvcmdqs_per_vintf = cmdqv->num_vcmdqs / cmdqv->num_vintfs;

This is a SW choice. HW supports more LVCMDQs than 2 per VINTF.

> Or maybe, re-word it to "if user space VM only wants one LVCMDQ for a
> VINTF, the current driver statically maps num_lvcmdqs_per_vintf which
> creates hidden vCMDQs [..]"

But yea, this makes sense. Will change.

Thanks
Nicolin