From patchwork Mon Oct 15 08:36:16 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Leizhen \(ThunderTown\)" X-Patchwork-Id: 148814 Delivered-To: patch@linaro.org Received: by 2002:a2e:8595:0:0:0:0:0 with SMTP id b21-v6csp3530488lji; Mon, 15 Oct 2018 01:37:57 -0700 (PDT) X-Google-Smtp-Source: ACcGV619Clho1kbIs7hYidjjWesqkJTUH6puYk/3EQjmFd8pilnBgNfjl2y89/p9eSzRzYHQ4pvg X-Received: by 2002:a62:3106:: with SMTP id x6-v6mr7238119pfx.154.1539592677790; Mon, 15 Oct 2018 01:37:57 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1539592677; cv=none; d=google.com; s=arc-20160816; b=bVZA2n+frr4FouSM3xeFvlUEbuehoyO08yM6G3oq2ArmIJBc2stPFOl4LnFqwV6c1I KQyGFqO8xGuHbLaNPmwwZXfox4Qq02X+Jr1G4v4gtQ7VNrW0HT7/6faW/Yj8LpDbV5AE 3u/pImJs1ql3e/bfPJQXay2YD8ZXVCN0D4mVZ+x6a4UhtjHHod4lZY0ngS+vAb12tMQu pOYjFNwtsKh/jtT8ZmGGL6XbKfQFFoNTdZEEl5D2d9U1C/W85rwnEyqV1thOYanP6Zoj gOuFXLTQsCfuJB3iUpHNklFW1woxoFwAWZdNJtGPC7xxFlgblSJe+OEPwVDKgqrhcr2V 1pig== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:mime-version:message-id:date:subject:cc :to:from; bh=njzqchq2HTjZ+v+hTp7pR5TUfBjNIZmIuqI4N00v/Zw=; b=S/IK0XLOyx11vSsXfCXoM6ktVWX0BhCLL7HP/LyqxL9fn/QHpbys2fnLapTaCUHJUA stZcXe1ppjNLiEpgXFK37MKimPtS0DOmKfffdm3yMQmrmGKy3iY2Wlk13mUehtY1a4zQ JmNZlKvYXne/FYyoh1iX8oPOgYbtO9MepVTtTvVnMQIdxM1O03MjYmOvxaM6+CmEbJlv FZbcR1Y414ORbckGXhEv+T71JasGonlbapQrzQulgbIhm/iWo1sNfpFEMiYRgmlO6pCr LPu+U3RKXE3OhSj5vDYUmRQq2pjXDa7cqlCD63he5+weYAVUVEFF5Bv87sqGlvp57FqD IFRg== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id o12-v6si9595244plk.360.2018.10.15.01.37.57; Mon, 15 Oct 2018 01:37:57 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726599AbeJOQWM (ORCPT + 32 others); Mon, 15 Oct 2018 12:22:12 -0400 Received: from szxga07-in.huawei.com ([45.249.212.35]:44729 "EHLO huawei.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1726357AbeJOQWL (ORCPT ); Mon, 15 Oct 2018 12:22:11 -0400 Received: from DGGEMS410-HUB.china.huawei.com (unknown [172.30.72.59]) by Forcepoint Email with ESMTP id 8E8F7A97B8A35; Mon, 15 Oct 2018 16:37:49 +0800 (CST) Received: from localhost (10.177.23.164) by DGGEMS410-HUB.china.huawei.com (10.3.19.210) with Microsoft SMTP Server id 14.3.399.0; Mon, 15 Oct 2018 16:37:44 +0800 From: Zhen Lei To: Robin Murphy , Will Deacon , Joerg Roedel , linux-arm-kernel , iommu , linux-kernel CC: Zhen Lei , LinuxArm Subject: [PATCH 1/1] iommu/arm-smmu-v3: eliminate a potential memory corruption on Hi16xx soc Date: Mon, 15 Oct 2018 16:36:16 +0800 Message-ID: <1539592576-24352-1-git-send-email-thunder.leizhen@huawei.com> X-Mailer: git-send-email 1.9.5.msysgit.0 MIME-Version: 1.0 X-Originating-IP: [10.177.23.164] X-CFilter-Loop: Reflected Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org ITS translation register map: 0x0000-0x003C Reserved 0x0040 GITS_TRANSLATER 0x0044-0xFFFC Reserved The standard GITS_TRANSLATER register in ITS is only 4 bytes, but Hisilicon expands the next 4 bytes to carry some IMPDEF information. That means, 8 bytes data will be written to MSIAddress each time. MSIAddr: |----4bytes----|----4bytes----| | MSIData | IMPDEF | There is no problem for ITS, because the next 4 bytes space is reserved in ITS. But it will overwrite the 4 bytes memory following "sync_count". It's very luckly that the previous and the next neighbour of "sync_count" are both aligned by 8 bytes, so no problem is met now. It's good to explicitly add a workaround: 1. Add gcc __attribute__((aligned(8))) to make sure that "sync_count" is always aligned by 8 bytes. 2. Add a "u64" union member to make sure the 4 bytes padding is always exist. There is no functional change. Signed-off-by: Zhen Lei --- drivers/iommu/arm-smmu-v3.c | 3 +++ 1 file changed, 3 insertions(+) -- 1.8.3 diff --git a/drivers/iommu/arm-smmu-v3.c b/drivers/iommu/arm-smmu-v3.c index 5059d09..a07bc0d 100644 --- a/drivers/iommu/arm-smmu-v3.c +++ b/drivers/iommu/arm-smmu-v3.c @@ -586,7 +586,10 @@ struct arm_smmu_device { struct arm_smmu_strtab_cfg strtab_cfg; + union { + u64 padding; /* workaround for Hisilicon */ u32 sync_count; + } __attribute__((aligned(8))); /* IOMMU core code handle */ struct iommu_device iommu;