lkml.org 
[lkml]   [2019]   [Jan]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 4.19 128/258] iommu/arm-smmu-v3: Avoid memory corruption from Hisilicon MSI payloads
    Date
    From: Zhen Lei <thunder.leizhen@huawei.com>

    [ Upstream commit 84a9a75774961612d0c7dd34a1777e8f98a65abd ]

    The GITS_TRANSLATER MMIO doorbell register in the ITS hardware is
    architected to be 4 bytes in size, yet on hi1620 and earlier, Hisilicon
    have allocated the adjacent 4 bytes to carry some IMPDEF sideband
    information which results in an 8-byte MSI payload being delivered when
    signalling an interrupt:

    MSIAddr:
    |----4bytes----|----4bytes----|
    | MSIData | IMPDEF |

    This poses no problem for the ITS hardware because the adjacent 4 bytes
    are reserved in the memory map. However, when delivering MSIs to memory,
    as we do in the SMMUv3 driver for signalling the completion of a SYNC
    command, the extended payload will corrupt the 4 bytes adjacent to the
    "sync_count" member in struct arm_smmu_device. Fortunately, the current
    layout allocates these bytes to padding, but this is fragile and we
    should make this explicit.

    Reviewed-by: Robin Murphy <robin.murphy@arm.com>
    Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
    [will: Rewrote commit message and comment]
    Signed-off-by: Will Deacon <will.deacon@arm.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/iommu/arm-smmu-v3.c | 6 +++++-
    1 file changed, 5 insertions(+), 1 deletion(-)

    diff --git a/drivers/iommu/arm-smmu-v3.c b/drivers/iommu/arm-smmu-v3.c
    index 3e02aace38b1..4afb9cb99ea3 100644
    --- a/drivers/iommu/arm-smmu-v3.c
    +++ b/drivers/iommu/arm-smmu-v3.c
    @@ -586,7 +586,11 @@ struct arm_smmu_device {

    struct arm_smmu_strtab_cfg strtab_cfg;

    - u32 sync_count;
    + /* Hi16xx adds an extra 32 bits of goodness to its MSI payload */
    + union {
    + u32 sync_count;
    + u64 padding;
    + };

    /* IOMMU core code handle */
    struct iommu_device iommu;
    --
    2.19.1
    \
     
     \ /
      Last update: 2019-01-28 18:18    [W:4.075 / U:0.204 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site