linux-kernel - [PATCH v2] iommu/arm-smmu-qcom: Work around SDM845 Adreno SMMU w/ 16K pages

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20240824-topic-845_gpu_smmu-v2-1-a302b8acc052@quicinc.com>
Date: Sat, 24 Aug 2024 01:12:01 +0200
From: Konrad Dybcio <konradybcio@...nel.org>
To: Bjorn Andersson <andersson@...nel.org>, Rob Clark <robdclark@...il.com>, 
 Will Deacon <will@...nel.org>, Robin Murphy <robin.murphy@....com>, 
 Joerg Roedel <joro@...tes.org>
Cc: Marijn Suijten <marijn.suijten@...ainline.org>, iommu@...ts.linux.dev, 
 linux-arm-msm@...r.kernel.org, linux-arm-kernel@...ts.infradead.org, 
 linux-kernel@...r.kernel.org, Konrad Dybcio <konrad.dybcio@...aro.org>, 
 Sumit Semwal <sumit.semwal@...aro.org>
Subject: [PATCH v2] iommu/arm-smmu-qcom: Work around SDM845 Adreno SMMU w/
 16K pages

From: Konrad Dybcio <konrad.dybcio@...aro.org>

SDM845's Adreno SMMU is unique in that it actually advertizes support
for 16K (and 32M) pages, which doesn't hold for newer SoCs.

This however, seems either broken in the hardware implementation, the
hypervisor middleware that abstracts the SMMU, or there's a bug in the
Linux kernel somewhere down the line that nobody managed to track down.

Booting SDM845 with 16K page sizes and drm/msm results in:

*** gpu fault: ttbr0=0000000000000000 iova=000100000000c000 dir=READ
type=TRANSLATION source=CP (0,0,0,0)

right after loading the firmware. The GPU then starts spitting out
illegal intstruction errors, as it's quite obvious that it got a
bogus pointer.

Moreover, it seems like this issue also concerns other implementations
of SMMUv2 on Qualcomm SoCs, such as the one on SC7180.

Hide 16K support on such instances to work around this.

Reported-by: Sumit Semwal <sumit.semwal@...aro.org>
Signed-off-by: Konrad Dybcio <konrad.dybcio@...aro.org>
---
Changes in v2:
- Extend to all Qualcomm SMMUv2 implementations
- Link to v1: https://lore.kernel.org/r/20240729-topic-845_gpu_smmu-v1-1-8e372abbde41@kernel.org
---
 drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c b/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c
index 36c6b36ad4ff..cca6d5b0bf5d 100644
--- a/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c
+++ b/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c
@@ -338,6 +338,14 @@ static int qcom_smmu_cfg_probe(struct arm_smmu_device *smmu)
 	return 0;
 }
 
+static int qcom_adreno_smmuv2_cfg_probe(struct arm_smmu_device *smmu)
+{
+	/* Support for 16K pages is advertised on some SoCs, but it doesn't seem to work */
+	smmu->features &= ~ARM_SMMU_FEAT_FMT_AARCH64_16K;
+
+	return 0;
+}
+
 static void qcom_smmu_write_s2cr(struct arm_smmu_device *smmu, int idx)
 {
 	struct arm_smmu_s2cr *s2cr = smmu->s2crs + idx;
@@ -436,6 +444,7 @@ static const struct arm_smmu_impl sdm845_smmu_500_impl = {
 
 static const struct arm_smmu_impl qcom_adreno_smmu_v2_impl = {
 	.init_context = qcom_adreno_smmu_init_context,
+	.cfg_probe = qcom_adreno_smmuv2_cfg_probe,
 	.def_domain_type = qcom_smmu_def_domain_type,
 	.alloc_context_bank = qcom_adreno_smmu_alloc_context_bank,
 	.write_sctlr = qcom_adreno_smmu_write_sctlr,

---
base-commit: 9243b36b254ffe3809eb0c8c565c287511a07f20
change-id: 20240726-topic-845_gpu_smmu-ab738f7a013c

Best regards,
-- 
Konrad Dybcio <quic_kdybcio@...cinc.com>