Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1157605

[PATCH 4.0 004/148] iommu/arm-smmu: Fix sign-extension of upstream bus addresses at stage 1

From Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Newsgroups linux.kernel
Subject [PATCH 4.0 004/148] iommu/arm-smmu: Fix sign-extension of upstream bus addresses at stage 1
Date 2015-06-03 15:00 +0200
Message-ID <pxgr3-1sR-69@gated-at.bofh.it> (permalink)
References <pxfOh-E4-3@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

4.0-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Will Deacon <will.deacon@arm.com>

commit 5dc5616ee850eaba055bb469a6c4a471d489140e upstream.

Stage 1 translation is controlled by two sets of page tables (TTBR0 and
TTBR1) which grow up and down from zero respectively in the ARMv8
translation regime. For the SMMU, we only care about TTBR0 and, in the
case of a 48-bit virtual space, we expect to map virtual addresses 0x0
through to 0xffff_ffff_ffff.

Given that some masters may be incapable of emitting virtual addresses
targetting TTBR1 (e.g. because they sit on a 48-bit bus), the SMMU
architecture allows bit 47 to be sign-extended, halving the virtual
range of TTBR0 but allowing TTBR1 to be used. This is controlled by the
SEP field in TTBCR2.

The SMMU driver incorrectly enables this sign-extension feature, which
causes problems when userspace addresses are programmed into a master
device with the SMMU expecting to map the incoming transactions via
TTBR0; if the top bit of address is set, we will instead get a
translation fault since TTBR1 walks are disabled in the TTBCR.

This patch fixes the issue by disabling sign-extension of a fixed
virtual address bit and instead basing the behaviour on the upstream bus
size: the incoming address is zero extended unless the upstream bus is
only 49 bits wide, in which case bit 48 is used as the sign bit and is
replicated to the upper bits.

Reported-by: Varun Sethi <varun.sethi@freescale.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/iommu/arm-smmu.c |   30 ++----------------------------
 1 file changed, 2 insertions(+), 28 deletions(-)

--- a/drivers/iommu/arm-smmu.c
+++ b/drivers/iommu/arm-smmu.c
@@ -224,14 +224,7 @@
 #define RESUME_TERMINATE		(1 << 0)
 
 #define TTBCR2_SEP_SHIFT		15
-#define TTBCR2_SEP_MASK			0x7
-
-#define TTBCR2_ADDR_32			0
-#define TTBCR2_ADDR_36			1
-#define TTBCR2_ADDR_40			2
-#define TTBCR2_ADDR_42			3
-#define TTBCR2_ADDR_44			4
-#define TTBCR2_ADDR_48			5
+#define TTBCR2_SEP_UPSTREAM		(0x7 << TTBCR2_SEP_SHIFT)
 
 #define TTBRn_HI_ASID_SHIFT            16
 
@@ -783,26 +776,7 @@ static void arm_smmu_init_context_bank(s
 		writel_relaxed(reg, cb_base + ARM_SMMU_CB_TTBCR);
 		if (smmu->version > ARM_SMMU_V1) {
 			reg = pgtbl_cfg->arm_lpae_s1_cfg.tcr >> 32;
-			switch (smmu->va_size) {
-			case 32:
-				reg |= (TTBCR2_ADDR_32 << TTBCR2_SEP_SHIFT);
-				break;
-			case 36:
-				reg |= (TTBCR2_ADDR_36 << TTBCR2_SEP_SHIFT);
-				break;
-			case 40:
-				reg |= (TTBCR2_ADDR_40 << TTBCR2_SEP_SHIFT);
-				break;
-			case 42:
-				reg |= (TTBCR2_ADDR_42 << TTBCR2_SEP_SHIFT);
-				break;
-			case 44:
-				reg |= (TTBCR2_ADDR_44 << TTBCR2_SEP_SHIFT);
-				break;
-			case 48:
-				reg |= (TTBCR2_ADDR_48 << TTBCR2_SEP_SHIFT);
-				break;
-			}
+			reg |= TTBCR2_SEP_UPSTREAM;
 			writel_relaxed(reg, cb_base + ARM_SMMU_CB_TTBCR2);
 		}
 	} else {


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 4.0 000/148] 4.0.5-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:00 +0200
  [PATCH 4.0 021/148] mfd: da9052: Fix broken regulator probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:00 +0200
  [PATCH 4.0 061/148] ASoC: wm8994: correct BCLK DIV 348 to 384 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:00 +0200
  [PATCH 4.0 026/148] hwmon: (ntc_thermistor) Ensure iio channel is of type IIO_VOLTAGE Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:00 +0200
  [PATCH 4.0 048/148] module: Call module notifier on failure after complete_formation() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:00 +0200
  [PATCH 4.0 053/148] ALSA: hda/realtek - ALC292 dock fix for Thinkpad L450 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:00 +0200
  [PATCH 4.0 046/148] lib: Fix strnlen_user() to not touch memory after specified maximum Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:00 +0200
  [PATCH 4.0 065/148] staging: vt6655: device_free_tx_buf use only ieee80211_tx_status_irqsafe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:00 +0200
  [PATCH 4.0 008/148] KVM: MMU: fix CR4.SMEP=1, CR0.WP=0 with shadow pages Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:00 +0200
  [PATCH 4.0 033/148] iio: adc: cc10001: Fix incorrect use of power-up/power-down register Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:00 +0200
  [PATCH 4.0 034/148] iio: adc: cc10001: Add delay before setting START bit Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:00 +0200
  [PATCH 4.0 040/148] hwmon: (tmp401) Do not auto-detect chip on I2C address 0x37 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:00 +0200
  [PATCH 4.0 049/148] ALSA: usb-audio: Add quirk for MS LifeCam Studio Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:00 +0200
  [PATCH 4.0 009/148] KVM: MMU: fix smap permission check Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:00 +0200
  [PATCH 4.0 023/148] Revert "libceph: clear r_req_lru_item in __unregister_linger_request()" Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:00 +0200
  [PATCH 4.0 050/148] ALSA: hda - Add Conexant codecs CX20721, CX20722, CX20723 and CX20724 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:00 +0200
  [PATCH 4.0 045/148] brcmfmac: avoid null pointer access when brcmf_msgbuf_get_pktid() fails Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:00 +0200
  [PATCH 4.0 035/148] iio: adc: cc10001: Fix regulator_get_voltage() return value check Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:00 +0200
  [PATCH 4.0 060/148] ASoC: wm8960: fix "RINPUT3" audio route error Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:00 +0200
  [PATCH 4.0 022/148] libceph: request a new osdmap if lingering request maps to no osd Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:00 +0200
  [PATCH 4.0 025/148] xen/events: dont bind non-percpu VIRQs with percpu chip Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:00 +0200
  [PATCH 4.0 004/148] iommu/arm-smmu: Fix sign-extension of upstream bus addresses at stage 1 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:00 +0200
  [PATCH 4.0 057/148] ASoC: mc13783: Fix wrong mask value used in mc13xxx_reg_rmw() calls Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:00 +0200
  [PATCH 4.0 024/148] Btrfs: fix racy system chunk allocation when setting block group ro Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:00 +0200
  [PATCH 4.0 051/148] ALSA: hda - Add headphone quirk for Lifebook E752 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:00 +0200
  [PATCH 4.0 007/148] x86/fpu: Disable XSAVES* support for now Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:00 +0200
  [PATCH 4.0 064/148] staging: vt6656: use ieee80211_tx_info to select packet type. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:00 +0200
  [PATCH 4.0 056/148] ALSA: hda - Fix noise on AMD radeon 290x controller Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:00 +0200
  [PATCH 4.0 003/148] iommu/amd: Fix bug in put_pasid_state_wait Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:00 +0200
  [PATCH 4.0 032/148] iio: adc: cc10001: Fix the channel number mapping Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:00 +0200
  [PATCH 4.0 015/148] omfs: fix sign confusion for bitmap loop counter Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:10 +0200
  [PATCH 4.0 018/148] lguest: fix out-by-one error in address checking. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:10 +0200
  [PATCH 4.0 002/148] fs_pin: Allow for the possibility that m_list or s_list go unused. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:10 +0200
  [PATCH 4.0 016/148] xfs: xfs_attr_inactive leaves inconsistent attr fork state behind Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:10 +0200
  [PATCH 4.0 014/148] fs, omfs: add NULL terminator in the end up the token list Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:10 +0200
  [PATCH 4.0 017/148] xfs: xfs_iozero can return positive errno Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:10 +0200
  [PATCH 4.0 019/148] ovl: dont remove non-empty opaque directory Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 15:10 +0200
  Re: [PATCH 4.0 000/148] 4.0.5-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2015-06-03 19:00 +0200

csiph-web