linux-kernel - [PATCH] iommu/arm-smmu-v3: Fix incorrect fields being passed to prefetch command

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 28 Jun 2019 14:39:53 +0530
From:   Pratyush Yadav <p-yadav1@...com>
To:     <will@...nel.org>, <robin.murphy@....com>, <joro@...tes.org>
CC:     <linux-arm-kernel@...ts.infradead.org>,
        <iommu@...ts.linux-foundation.org>, <linux-kernel@...r.kernel.org>,
        <wmills@...com>, <nsekhar@...com>, <lokeshvutla@...com>,
        Pratyush Yadav <p-yadav1@...com>
Subject: [PATCH] iommu/arm-smmu-v3: Fix incorrect fields being passed to prefetch command

According to the SMMUv3 spec [0] section 4.2.1, command 0x1
(CMD_PREFETCH_CONFIG) does not take address and size as parameters. It
only takes  StreamID, SSec, SubstreamID, and SSV. Address and Size are
parameters for command 0x2 (CMD_PREFETCH_ADDR).

Tested on kernel 4.19 on TI J721E SOC.

[0] https://static.docs.arm.com/ihi0070/a/IHI_0070A_SMMUv3.pdf

Signed-off-by: Pratyush Yadav <p-yadav1@...com>
---
 drivers/iommu/arm-smmu-v3.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/iommu/arm-smmu-v3.c b/drivers/iommu/arm-smmu-v3.c
index 4d5a694f02c2..2d4dfd909436 100644
--- a/drivers/iommu/arm-smmu-v3.c
+++ b/drivers/iommu/arm-smmu-v3.c
@@ -413,6 +413,7 @@ struct arm_smmu_cmdq_ent {
 	/* Command-specific fields */
 	union {
 		#define CMDQ_OP_PREFETCH_CFG	0x1
+		#define CMDQ_OP_PREFETCH_ADDR	0x2
 		struct {
 			u32			sid;
 			u8			size;
@@ -805,10 +806,12 @@ static int arm_smmu_cmdq_build_cmd(u64 *cmd, struct arm_smmu_cmdq_ent *ent)
 	case CMDQ_OP_TLBI_EL2_ALL:
 	case CMDQ_OP_TLBI_NSNH_ALL:
 		break;
-	case CMDQ_OP_PREFETCH_CFG:
-		cmd[0] |= FIELD_PREP(CMDQ_PREFETCH_0_SID, ent->prefetch.sid);
+	case CMDQ_OP_PREFETCH_ADDR:
 		cmd[1] |= FIELD_PREP(CMDQ_PREFETCH_1_SIZE, ent->prefetch.size);
 		cmd[1] |= ent->prefetch.addr & CMDQ_PREFETCH_1_ADDR_MASK;
+		/* Fallthrough */
+	case CMDQ_OP_PREFETCH_CFG:
+		cmd[0] |= FIELD_PREP(CMDQ_PREFETCH_0_SID, ent->prefetch.sid);
 		break;
 	case CMDQ_OP_CFGI_STE:
 		cmd[0] |= FIELD_PREP(CMDQ_CFGI_0_SID, ent->cfgi.sid);
-- 
2.17.1