linux-kernel - [PATCH] iommu/arm-smmu-qcom: Work around SDM845 Adreno SMMU w/ 16K pages

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20240729-topic-845_gpu_smmu-v1-1-8e372abbde41@kernel.org>
Date: Mon, 29 Jul 2024 10:37:48 +0200
From: Konrad Dybcio <konradybcio@...nel.org>
To: Bjorn Andersson <andersson@...nel.org>, Rob Clark <robdclark@...il.com>, 
 Will Deacon <will@...nel.org>, Robin Murphy <robin.murphy@....com>, 
 Joerg Roedel <joro@...tes.org>
Cc: Marijn Suijten <marijn.suijten@...ainline.org>, iommu@...ts.linux.dev, 
 linux-arm-msm@...r.kernel.org, linux-arm-kernel@...ts.infradead.org, 
 linux-kernel@...r.kernel.org, Konrad Dybcio <konrad.dybcio@...aro.org>, 
 Sumit Semwal <sumit.semwal@...aro.org>
Subject: [PATCH] iommu/arm-smmu-qcom: Work around SDM845 Adreno SMMU w/ 16K
 pages

From: Konrad Dybcio <konrad.dybcio@...aro.org>

SDM845's Adreno SMMU is unique in that it actually advertizes support
for 16K (and 32M) pages, which doesn't hold for newer SoCs.

This however, seems either broken in the hardware implementation, the
hypervisor middleware that abstracts the SMMU, or there's a bug in the
Linux kernel somewhere down the line that nobody managed to track down.

Booting SDM845 with 16K page sizes and drm/msm results in:

*** gpu fault: ttbr0=0000000000000000 iova=000100000000c000 dir=READ
type=TRANSLATION source=CP (0,0,0,0)

right after loading the firmware. The GPU then starts spitting out
illegal intstruction errors, as it's quite obvious that it got a
bogus pointer.

Hide 16K support on SDM845's Adreno SMMU to work around this.

Reported-by: Sumit Semwal <sumit.semwal@...aro.org>
Signed-off-by: Konrad Dybcio <konrad.dybcio@...aro.org>
---
There's a mismatch in sender/committer addresses but that's "fine":
https://lore.kernel.org/linux-usb/2024072734-scenic-unwilling-71ea@gregkh/
---
 drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c b/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c
index 36c6b36ad4ff..d25825c05817 100644
--- a/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c
+++ b/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c
@@ -338,6 +338,15 @@ static int qcom_smmu_cfg_probe(struct arm_smmu_device *smmu)
 	return 0;
 }
 
+static int qcom_adreno_smmuv2_cfg_probe(struct arm_smmu_device *smmu)
+{
+	/* SDM845 Adreno SMMU advertizes 16K pages support, but something is broken */
+	if (of_device_is_compatible(smmu->dev->of_node, "qcom,sdm845-smmu-v2"))
+		smmu->features &= ~ARM_SMMU_FEAT_FMT_AARCH64_16K;
+
+	return 0;
+}
+
 static void qcom_smmu_write_s2cr(struct arm_smmu_device *smmu, int idx)
 {
 	struct arm_smmu_s2cr *s2cr = smmu->s2crs + idx;
@@ -436,6 +445,7 @@ static const struct arm_smmu_impl sdm845_smmu_500_impl = {
 
 static const struct arm_smmu_impl qcom_adreno_smmu_v2_impl = {
 	.init_context = qcom_adreno_smmu_init_context,
+	.cfg_probe = qcom_adreno_smmuv2_cfg_probe,
 	.def_domain_type = qcom_smmu_def_domain_type,
 	.alloc_context_bank = qcom_adreno_smmu_alloc_context_bank,
 	.write_sctlr = qcom_adreno_smmu_write_sctlr,

---
base-commit: 931a3b3bccc96e7708c82b30b2b5fa82dfd04890
change-id: 20240726-topic-845_gpu_smmu-ab738f7a013c

Best regards,
-- 
Konrad Dybcio <konradybcio@...nel.org>