forked from Minki/linux
5dc5616ee8
Stage 1 translation is controlled by two sets of page tables (TTBR0 and TTBR1) which grow up and down from zero respectively in the ARMv8 translation regime. For the SMMU, we only care about TTBR0 and, in the case of a 48-bit virtual space, we expect to map virtual addresses 0x0 through to 0xffff_ffff_ffff. Given that some masters may be incapable of emitting virtual addresses targetting TTBR1 (e.g. because they sit on a 48-bit bus), the SMMU architecture allows bit 47 to be sign-extended, halving the virtual range of TTBR0 but allowing TTBR1 to be used. This is controlled by the SEP field in TTBCR2. The SMMU driver incorrectly enables this sign-extension feature, which causes problems when userspace addresses are programmed into a master device with the SMMU expecting to map the incoming transactions via TTBR0; if the top bit of address is set, we will instead get a translation fault since TTBR1 walks are disabled in the TTBCR. This patch fixes the issue by disabling sign-extension of a fixed virtual address bit and instead basing the behaviour on the upstream bus size: the incoming address is zero extended unless the upstream bus is only 49 bits wide, in which case bit 48 is used as the sign bit and is replicated to the upper bits. Cc: <stable@vger.kernel.org> # v4.0+ Reported-by: Varun Sethi <varun.sethi@freescale.com> Signed-off-by: Will Deacon <will.deacon@arm.com> Signed-off-by: Joerg Roedel <jroedel@suse.de> |
||
|---|---|---|
| .. | ||
| amd_iommu_init.c | ||
| amd_iommu_proto.h | ||
| amd_iommu_types.h | ||
| amd_iommu_v2.c | ||
| amd_iommu.c | ||
| arm-smmu.c | ||
| dmar.c | ||
| exynos-iommu.c | ||
| fsl_pamu_domain.c | ||
| fsl_pamu_domain.h | ||
| fsl_pamu.c | ||
| fsl_pamu.h | ||
| intel_irq_remapping.c | ||
| intel-iommu.c | ||
| io-pgtable-arm.c | ||
| io-pgtable.c | ||
| io-pgtable.h | ||
| iommu-sysfs.c | ||
| iommu-traces.c | ||
| iommu.c | ||
| iova.c | ||
| ipmmu-vmsa.c | ||
| irq_remapping.c | ||
| irq_remapping.h | ||
| Kconfig | ||
| Makefile | ||
| msm_iommu_dev.c | ||
| msm_iommu_hw-8xxx.h | ||
| msm_iommu.c | ||
| msm_iommu.h | ||
| of_iommu.c | ||
| omap-iommu-debug.c | ||
| omap-iommu.c | ||
| omap-iommu.h | ||
| omap-iopgtable.h | ||
| rockchip-iommu.c | ||
| shmobile-iommu.c | ||
| shmobile-ipmmu.c | ||
| shmobile-ipmmu.h | ||
| tegra-gart.c | ||
| tegra-smmu.c | ||