linux-kernel - [PATCH v4] iommu/arm-smmu-qcom: Limit the SMR groups to 128

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 21 Mar 2023 14:43:32 +0530
From:   Manivannan Sadhasivam <manivannan.sadhasivam@...aro.org>
To:     will@...nel.org, joro@...tes.org
Cc:     robin.murphy@....com, andersson@...nel.org,
        johan+linaro@...nel.org, steev@...i.org,
        linux-arm-kernel@...ts.infradead.org, iommu@...ts.linux.dev,
        linux-kernel@...r.kernel.org,
        Manivannan Sadhasivam <manivannan.sadhasivam@...aro.org>
Subject: [PATCH v4] iommu/arm-smmu-qcom: Limit the SMR groups to 128

On some Qualcomm platforms, the hypervisor emulates more than 128 SMR
(Stream Matching Register) groups. This doesn't conform to the ARM SMMU
architecture specification which defines the range of 0-127. Moreover, the
emulated groups don't exhibit the same behavior as the architecture
supported ones.

For instance, emulated groups will not detect the quirky behavior of some
firmware versions intercepting writes to S2CR register, thus skipping the
quirk implemented in the driver and causing boot crash.

So let's limit the groups to 128 and issue a notice to users in that case.

Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@...aro.org>
---

Changes in v4:

* Spun off the SMR limiting part into a separate patch
* Dropped the quirk rework part as it is not really needed for now

Changes in v3:

* Limited num_mapping_groups to 128 as per ARM SMMU spec and removed the
  check for 128 groups in qcom_smmu_bypass_quirk()
* Reworded the commit message accordingly

Changes in v2:

* Limited the check to 128 groups as per ARM SMMU spec's NUMSMRG range
* Moved the quirk handling to its own function
* Collected review tag from Bjorn

 drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c b/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c
index d1b296b95c86..54f62d409619 100644
--- a/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c
+++ b/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c
@@ -268,12 +268,26 @@ static int qcom_smmu_init_context(struct arm_smmu_domain *smmu_domain,
 
 static int qcom_smmu_cfg_probe(struct arm_smmu_device *smmu)
 {
-	unsigned int last_s2cr = ARM_SMMU_GR0_S2CR(smmu->num_mapping_groups - 1);
 	struct qcom_smmu *qsmmu = to_qcom_smmu(smmu);
+	unsigned int last_s2cr;
 	u32 reg;
 	u32 smr;
 	int i;
 
+	/*
+	 * Limit the number of stream matching groups to 128 as the ARM SMMU
+	 * architecture specification defines NUMSMRG (Number of Stream Mapping
+	 * Register Groups) in the range of 0-127, but some Qcom platforms
+	 * emulate more stream mapping groups. And those groups don't exhibit
+	 * the same behavior as the architecture supported ones.
+	 */
+	if (smmu->num_mapping_groups > 128) {
+		dev_notice(smmu->dev, "\tLimiting the stream matching groups to 128\n");
+		smmu->num_mapping_groups = 128;
+	}
+
+	last_s2cr = ARM_SMMU_GR0_S2CR(smmu->num_mapping_groups - 1);
+
 	/*
 	 * With some firmware versions writes to S2CR of type FAULT are
 	 * ignored, and writing BYPASS will end up written as FAULT in the
-- 
2.25.1