From nobody Fri Apr 3 20:54:58 2026 Received: from mail-wr1-f42.google.com (mail-wr1-f42.google.com [209.85.221.42]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C72B81E2614 for ; Mon, 23 Mar 2026 13:09:36 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.42 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774271378; cv=none; b=eLQ6R1X+Yp3rK+7iUCc+xhR9vw/323rbM8TriSxoOJ6T1TF84ARwMZuGOkdhxhsNl1tKQ0UxTrpwHHDrlXiK2HR7t0tpyUMkOzK2pu9ua/PmkQliAQcGQ7UxQ8qzCwyAj4bNIDxzgVk9xT/CjnMWC4tqqZcPlKSBknvUF6j7ulw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774271378; c=relaxed/simple; bh=lTpldD4eL76NbvK555N/Xx2Kd24uIcQoPu7MsvhV6l0=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:To:Cc; b=DPAvH1m9fq+y2kbhtoi+q1Afej3XtivYl7npRikgGELpYGIjZRROLhKxd2jPGmmqLEehjjQAu/Inz4NsQSvSUJCcvvSmpZAWlzMNBAdtPr8oioNrU9L4nAcfqkyk3ShAUu4pe6/kPeMYsmEnZWpOhL/gFx6bt9dM3jxtnKukSCc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linaro.org; spf=pass smtp.mailfrom=linaro.org; dkim=pass (2048-bit key) header.d=linaro.org header.i=@linaro.org header.b=hbFLUyv8; arc=none smtp.client-ip=209.85.221.42 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linaro.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=linaro.org header.i=@linaro.org header.b="hbFLUyv8" Received: by mail-wr1-f42.google.com with SMTP id ffacd0b85a97d-43b49819938so1697849f8f.0 for ; Mon, 23 Mar 2026 06:09:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; t=1774271375; x=1774876175; darn=vger.kernel.org; h=cc:to:message-id:content-transfer-encoding:mime-version:subject :date:from:from:to:cc:subject:date:message-id:reply-to; bh=NfzC67OFUc9pr0Vnc62IO92SI4BJtFnpHt3IPGw5yvg=; b=hbFLUyv8amQlLvUybV20ua7naznupMz7vdzYZCPbd6fhL0rvE8hnxOJKdpS2XtNZbC cxqGTCjauO/k3i+rSGvs2WN1KXkKHZDM495b9iOBa7YTezelET6EVnZjE9tbpYdhre0L HApHxY6TeMFEGahx4NcE/5cs0RwgZmy/AFmLroEafh62HGKVLkySmMvSC/wwuTSlZT2v 4iEBvHWe29prYkiolagEpB4xvtVLhhpogjEes3UEpxYFJMzIS4jxNZbRa5/TTcjUxBH2 ZetGDIZLXTuYi324fyHXXYv6YzOy+2s0b1NABcII63Mq4Ov4dXUgh0lsl5gi7uSN/wyK M4BA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1774271375; x=1774876175; h=cc:to:message-id:content-transfer-encoding:mime-version:subject :date:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=NfzC67OFUc9pr0Vnc62IO92SI4BJtFnpHt3IPGw5yvg=; b=fEwFSZ+uS1rDNcxZBcchynHGtw3m2A/qdh8rqGKh7gt2qStilxvgLeIwrgTmU9oJpi VlbE2Cdz6qUxdUG6FmZLcKV50quZ4jzvdRtWkvGgU8KDrUhKKZbJhnmOsjO9/y/vL4s3 7kzHTzJdQQObKcnbwsTdXV/YrzqCTE/og8SyLBZzTJnFxgSr6/rRvH9FMjlCQYsIlUu7 FjeE4oweGT32RybW5u5bwNhsBAZN609WdnwpjE0Ar9925OudocnP0+t3fjqLF/QZs/Fk MFzZva5SNiag+1hFX0EbaE6FflKnNj18SFczRbaGU7enIenVxJKCKHN0S7E1peTLuoy2 rzZQ== X-Forwarded-Encrypted: i=1; AJvYcCWSlifEjPVPDe0nQaEcCUKAlLkuFKMBiQt2LVKBqka3O8c0JKxXXmFt8ljP0HEbN9pTCol4vWEUZwsSWZM=@vger.kernel.org X-Gm-Message-State: AOJu0Yyb2Lza9/pxVJDrdx+f0vYufDSGblQX9dsrSjAosPrhSUqCurjJ DMBnfO2DAVNfZoes2ugZ+6415VNkJSKX2oevq21rOi7kyeAUYzrYESI69mKa/MUC/0o= X-Gm-Gg: ATEYQzxubyHp2K8EJhlmDoela/AEAUdT0jTLj0W9iByaQ7X5aO8wJ2FdDW3+Lsx+YYy jIRdCZXaATTabvGN29qknR/vwCYgCHlfycQWhxJN1G2CbVpR8Vrf2Tayqxw6uwtZd1aRHLyqtlC mNfja6d7Ls7Bo4O41DvL+2jMxys+MKsZptQt8Yo4SiUodvGscyIcmez1CuJW691vftnXSSPsGBE u5CfBQzqm5dDgfBW96Qxsf8PlV8Udha4+0vWxFr6bhCzHIEiQkcmxrLRVgJ3C+TzaJVzFkNVPQR uy1iv681gyHLzZpn6K+6d2s4tpoHRshtqvxcSkzWKLgdKiC7ZK+n+D5UKS+zwzEj4phBIeD/vfn cJl1IRu6xDbfj5TaXPVIcRnd65ynqqOQj5pW8KG+IwgHmLZ5RPN0MAAzlehZPz/MLModwphLNxb rJEjTKlfnINCb78ydaSL2ctxD4lBM4VfDw4Dk3MUmukAXD19XABRkVTaFw/lsKCwGtfDa59VBww 7AkOD8lBp0SUUNRrA== X-Received: by 2002:a05:6000:2203:b0:43b:46b6:87aa with SMTP id ffacd0b85a97d-43b64277e1amr18640357f8f.27.1774271375078; Mon, 23 Mar 2026 06:09:35 -0700 (PDT) Received: from ta2.c.googlers.com (140.204.78.34.bc.googleusercontent.com. [34.78.204.140]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-43b6470c239sm29651241f8f.27.2026.03.23.06.09.34 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 23 Mar 2026 06:09:34 -0700 (PDT) From: Tudor Ambarus Date: Mon, 23 Mar 2026 13:09:27 +0000 Subject: [PATCH] iommu: Fix bypass of IOMMU readiness check for multi-IOMMU devices Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260323-iommu-ready-check-v1-1-5f6fef8f9f59@linaro.org> X-B4-Tracking: v=1; b=H4sIAIY7wWkC/x3MQQ5AMBBA0avIrE1SRamriIXUYCJU2hDS9O4ay 7f4P4Anx+ShywI4utmzPRKKPAOzjsdCyFMySCGVKKVAtvt+oaNxetGsZDasdKNaVeq6MRJSdzq a+fmf/RDjBy7q+fRjAAAA X-Change-ID: 20260320-iommu-ready-check-4976863957c2 To: Joerg Roedel , Will Deacon , Robin Murphy , Lorenzo Pieralisi , Jason Gunthorpe , "Rob Herring (Arm)" Cc: Joerg Roedel , Bjorn Helgaas , iommu@lists.linux.dev, linux-kernel@vger.kernel.org, peter.griffin@linaro.org, andre.draszik@linaro.org, willmcvicker@google.com, jyescas@google.com, kernel-team@android.com, stable@vger.kernel.org, Tudor Ambarus X-Mailer: b4 0.14.3 X-Developer-Signature: v=1; a=ed25519-sha256; t=1774271374; l=2378; i=tudor.ambarus@linaro.org; s=20241212; h=from:subject:message-id; bh=lTpldD4eL76NbvK555N/Xx2Kd24uIcQoPu7MsvhV6l0=; b=t55I53gjpaEnmHL4phC4I+QSAaGYecA0xntMB6DObcA3FXm8m3v3G7Z/pZ44CrPmDg4EYupY7 2+TC4ZG5EZUAIYs/zpKafQyyyqzwRsarbQ0Rz4wCnYTwwXlEdzGE9DF X-Developer-Key: i=tudor.ambarus@linaro.org; a=ed25519; pk=uQzE0NXo3dIjeowMTOPCpIiPHEz12IA/MbyzrZVh9WI= Commit da33e87bd2bf ("iommu: Handle yet another race around registration") introduced a readiness check in `iommu_fwspec_init()` to prevent client drivers from configuring their IOMMUs before `bus_iommu_probe()` has completed. To optimize the replay path, the readiness check was conditionally gated behind `!dev->iommu`: if (!dev->iommu && !READ_ONCE(iommu->ready)) return -EPROBE_DEFER; However, this assumption breaks down for devices that map to multiple IOMMU instances. During the initialization loop over multiple IOMMUs in `of_iommu_configure_device()`, the first IOMMU successfully allocates `dev->iommu`. When `iommu_fwspec_init()` is called for the second IOMMU, `!dev->iommu` evaluates to false, short-circuiting the logic and entirely bypassing the `iommu->ready` check. If the second IOMMU is still executing its `bus_iommu_probe()` concurrently, this allows the client driver to proceed prematurely, resulting in a late IOMMU probe warning: dev: late IOMMU probe at driver bind, something fishy here! WARNING: drivers/iommu/iommu.c:645 at __iommu_probe_device Fix this by making the `iommu->ready` check unconditional, ensuring that a device will defer its probe until *all* of its required IOMMUs are fully registered and ready. Cc: stable@vger.kernel.org Fixes: da33e87bd2bf ("iommu: Handle yet another race around registration") Fixes: bcb81ac6ae3c ("iommu: Get DT/ACPI parsing into the proper probe path= ") Signed-off-by: Tudor Ambarus --- The warning was observed using an Android 6.19 tree, using downstream drivers (exynos-decon and samsung-sysmmu-v9). --- drivers/iommu/iommu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c index 78756c3f3c40..e61927b4d41f 100644 --- a/drivers/iommu/iommu.c +++ b/drivers/iommu/iommu.c @@ -3042,7 +3042,7 @@ int iommu_fwspec_init(struct device *dev, struct fwno= de_handle *iommu_fwnode) =20 if (!iommu) return driver_deferred_probe_check_state(dev); - if (!dev->iommu && !READ_ONCE(iommu->ready)) + if (!READ_ONCE(iommu->ready)) return -EPROBE_DEFER; =20 if (fwspec) --- base-commit: ca3bbc9287400c1274d87ee57a16e3126ba2969a change-id: 20260320-iommu-ready-check-4976863957c2 Best regards, --=20 Tudor Ambarus