linux-kernel - BUG: "iommu: Retire bus ops" breaks omap-iommu and omap3isp

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <A7C284A9-33A5-4E21-9B57-9C4C213CC13F@goldelico.com>
Date: Sun, 6 Oct 2024 09:40:00 +0200
From: "H. Nikolaus Schaller" <hns@...delico.com>
To: Robin Murphy <robin.murphy@....com>,
 Laurent Pinchart <laurent.pinchart@...asonboard.com>
Cc: "Rafael J. Wysocki" <rafael.j.wysocki@...el.com>,
 Christoph Hellwig <hch@....de>,
 Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
 Lu Baolu <baolu.lu@...ux.intel.com>,
 Jason Gunthorpe <jgg@...dia.com>,
 Jerry Snitselaar <jsnitsel@...hat.com>,
 Robin Murphy <robin.murphy@....com>,
 Joerg Roedel <jroedel@...e.de>,
 tony Lindgren <tony@...mide.com>,
 Andreas Kemnade <andreas@...nade.info>,
 Linux-OMAP <linux-omap@...r.kernel.org>,
 Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
 linux-media@...r.kernel.org
Subject: BUG: "iommu: Retire bus ops" breaks omap-iommu and omap3isp

Hi,

I found that the camera on our OMAP3 based system (GTA04) stopped working with v6.8-rc1.
There was no bug in the camera driver but the OMAP3 ISP (image signal processor) emits

[   14.963684] omap3isp 480bc000.isp: failed to create ARM IOMMU mapping
[   15.010192] omap3isp 480bc000.isp: unable to attach to IOMMU
[   15.023376] omap3isp 480bc000.isp: isp_xclk_set_rate: cam_xclka set to 24685714 Hz (div 7)
[   15.065399] omap3isp: probe of 480bc000.isp failed with error -12

Deeper analyses lead to this patch breaking operation. It is not fixed up to v6.12-rc1.

What seems to happen (in 6.8-rc1 code):

- omap_iommu_probe() passes &omap_iommu_ops to iommu_device_register()
- iommu_device_register() stores the ops in iommu->ops (only)
- __iommu_probe_device tries to read the ops from some fw_spec but not iommu->ops
- this calls iommu_ops_from_fwnode(NULL) which looks strange to me
- since it doesn't find any fw_spec or node matching a NULL fwspec it returns -ENODEV

So I wonder how the magic between setting the ops in omap_iommu_probe()
and finding them in __iommu_probe_device() is intended to work. Or how
the omap3isp driver should register some fw_node or fw_spec to make this
work.

What is a fix for this?

BR and thanks,
Nikolaus

Bug: 17de3f5fdd3567 ("iommu: Retire bus ops")

Note: Why did this bug not surface earlier? It appears that on OMAP3 the only driver
that uses iommu is omap3isp and connected cameras are not that widespread.
OMAP4 and 5 also use it for the DSP&IVA susbsystems which are also rarely used.
Hence it wasn't tested by anyone.