• Zhen Lei's avatar
    iommu/arm-smmu-v3: Avoid memory corruption from Hisilicon MSI payloads · 84a9a757
    Zhen Lei authored
    The GITS_TRANSLATER MMIO doorbell register in the ITS hardware is
    architected to be 4 bytes in size, yet on hi1620 and earlier, Hisilicon
    have allocated the adjacent 4 bytes to carry some IMPDEF sideband
    information which results in an 8-byte MSI payload being delivered when
    signalling an interrupt:
    
    MSIAddr:
    	 |----4bytes----|----4bytes----|
    	 |    MSIData   |    IMPDEF    |
    
    This poses no problem for the ITS hardware because the adjacent 4 bytes
    are reserved in the memory map. However, when delivering MSIs to memory,
    as we do in the SMMUv3 driver for signalling the completion of a SYNC
    command, the extended payload will corrupt the 4 bytes adjacent to the
    "sync_count" member in struct arm_smmu_device. Fortunately, the current
    layout allocates these bytes to padding, but this is fragile and we
    should make this explicit.
    Reviewed-by: default avatarRobin Murphy <robin.murphy@arm.com>
    Signed-off-by: default avatarZhen Lei <thunder.leizhen@huawei.com>
    [will: Rewrote commit message and comment]
    Signed-off-by: default avatarWill Deacon <will.deacon@arm.com>
    84a9a757
arm-smmu-v3.c 75.9 KB