On Tue, Dec 09, 2025 at 01:33:36PM +0000, Robin Murphy wrote:

On 2025-12-09 12:37 pm, Mostafa Saleh wrote:

quoted

On Tue, Dec 09, 2025 at 11:34:34AM +0000, Robin Murphy wrote:

quoted

On 2025-11-30 7:45 pm, Mostafa Saleh wrote:

quoted

arm_lpae_concat_mandatory() assumes that OAS >= IAS which is not
correct for SMMUs supporting AArch32, and have OAS = 32/36 bits,
as IAS would be 40 bits.

But that is only when *using* AArch32 format. The bit in chapter 3.4 of the
SMMU architecture is talking about the maximum IAS that an SMMU
implementation needs to be able to accommodate based on its configuration,
but it does then attempt to clarify that the actual IPA size in use by any
given context should depend on the VMSA format in use:

"VMSAv8-32 LPAE always supports an IPA size of 40 bits, whereas VMSAv8-64
and VMSAv9-128 limits the maximum IPA size to the maximum PA size."

Rule R_SRKBC in the Arm ARM lays out the exact T0SZ constraints with this
AArch32/AArch64 detail.

I see, thanks a lot for the explanation, I got confused by the this
statement:
Note: If AArch32 is implemented, IAS == MAX(40, OAS), otherwise IAS == OAS.

Indeed, that appears confusingly contradictory; I've filed a bug.

quoted

However, I think this is still a bug but somewere else, as at the moment
the SMMUv3 dirver will use the SMMU IAS (40-bits) as input for AArch64
stage-2 page tables, so we need either to limit the IAS as:

diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
index d16d35c78c06..d21153156daa 100644
--- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
+++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c

@@ -2561,7 +2561,7 @@ static int arm_smmu_domain_finalise(struct arm_smmu_domain *smmu_domain,
         case ARM_SMMU_DOMAIN_S2:
                 if (enable_dirty)
                         return -EOPNOTSUPP;
-               pgtbl_cfg.ias = smmu->ias;
+               pgtbl_cfg.ias = min(smmu->ias, smmu->oas);
                 pgtbl_cfg.oas = smmu->oas;
                 fmt = ARM_64_LPAE_S2;
                 finalise_stage_fn = arm_smmu_domain_finalise_s2;

Or, don't populate IAS depending on AArch32 support as the driver
doesn't support it, effectively reverting:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f0c453dbcce7767cd868deb809ba68083c93954e

It does appear we've missed the detail here. TBH I'm not really sure why
we're bothering to consider the theoretical maximum IAS at all when it only
makes any difference to a format we've never cared about supporting anyway.
Frankly I'd be inclined to just remove smmu->ias altogether - even if we did
ever want to support LPAE format, it would be just as trivial for that to
hard-code pgtbl_cfg.ias = 40 based on the architecture rules.

Makes sense, I will prepare a patch.

Thanks,
Mostafa

Thanks,
Robin.