From 92b6e80fcd680bf7eb71b389a28e5f07531c939c Mon Sep 17 00:00:00 2001
From: Brent <1550934+brentkearney@users.noreply.github.com>
Date: Wed, 2 Sep 2026 20:19:07 -0600
Subject: [PATCH] soc: apple: sep: unmap the firmware IOVA, not the physical
 address

load_fw_and_shmem() maps the SEP firmware region with dma_map_resource(),
which returns an IOVA, but keeps only the shifted copy needed for the
MSG_BOOT_IMG4 message and discards the IOVA itself. remove() then calls
dma_unmap_resource() with region_params.addr, the physical address of the
reserved region.

The two are unrelated, so the unmap tears down page table entries that were
never present, and the real mapping is leaked. On t6000 the region sits at
0x10006340000, far outside the device's DART address space, and unbinding
the driver warns twice:

  WARNING: drivers/iommu/io-pgtable-dart.c:308 at dart_unmap_pages+0x11c/0x140
   dart_unmap_pages+0x11c/0x140
   apple_dart_unmap_pages+0x24/0x30
   __iommu_dma_unmap+0x94/0x140
   iommu_dma_unmap_phys+0xf8/0x118
   ...3sep9SepDriverEE20post_unbind_callback+0x34/0x70

  WARNING: drivers/iommu/dma-iommu.c:844 at __iommu_dma_unmap+0x128/0x140
   __iommu_dma_unmap+0x128/0x140
   iommu_dma_unmap_phys+0xf8/0x118
   ...3sep9SepDriverEE20post_unbind_callback+0x34/0x70

Keep the IOVA alongside the existing fw_mapped flag and unmap that instead.

Reproduced on an Apple MacBook Pro (16-inch, 2021), t6000/j316s, by
enabling the sep node and unbinding the driver.
---
 drivers/soc/apple/sep.rs | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/soc/apple/sep.rs b/drivers/soc/apple/sep.rs
index bcceb7ed4a6c41..08ea96e3d0a962 100644
--- a/drivers/soc/apple/sep.rs
+++ b/drivers/soc/apple/sep.rs
@@ -177,6 +177,7 @@ struct SepData {
     shmem: ShMem,
     region_params: FwRegionParams,
     fw_mapped: Atomic<bool>,
+    fw_iova: Atomic<u64>,
 }
 
 impl SepData {
@@ -191,6 +192,7 @@ impl SepData {
                 mbox <- new_mutex!(None),
                 region_params,
                 fw_mapped: Atomic::new(false),
+                fw_iova: Atomic::new(0),
             }),
             GFP_KERNEL,
         )
@@ -217,6 +219,7 @@ impl SepData {
                 dev_err!(self.dev, "Failed to map firmware");
                 return Err(ENOMEM);
             }
+            self.fw_iova.store(res, Relaxed);
             self.fw_mapped.store(true, Relaxed);
             res >> IOVA_SHIFT
         };
@@ -287,7 +290,7 @@ impl SepData {
             unsafe {
                 bindings::dma_unmap_resource(
                     self.dev.as_raw(),
-                    self.region_params.addr,
+                    self.fw_iova.load(Relaxed),
                     self.region_params.size,
                     bindings::dma_data_direction_DMA_TO_DEVICE,
                     0,