| From a69c7b64944b21fc3eacde416a30bd215c83671b Mon Sep 17 00:00:00 2001 |
| From: David Stevens <stevensd@chromium.org> |
| Date: Wed, 29 Sep 2021 11:33:00 +0900 |
| Subject: [PATCH] BACKPORT: FROMGIT: iommu/dma: Account for min_align_mask |
| w/swiotlb |
| |
| Pass the non-aligned size to __iommu_dma_map when using swiotlb bounce |
| buffers in iommu_dma_map_page, to account for min_align_mask. |
| |
| To deal with granule alignment, __iommu_dma_map maps iova_align(size + |
| iova_off) bytes starting at phys - iova_off. If iommu_dma_map_page |
| passes aligned size when using swiotlb, then this becomes |
| iova_align(iova_align(orig_size) + iova_off). Normally iova_off will be |
| zero when using swiotlb. However, this is not the case for devices that |
| set min_align_mask. When iova_off is non-zero, __iommu_dma_map ends up |
| mapping an extra page at the end of the buffer. Beyond just being a |
| security issue, the extra page is not cleaned up by __iommu_dma_unmap. |
| This causes problems when the IOVA is reused, due to collisions in the |
| iommu driver. Just passing the original size is sufficient, since |
| __iommu_dma_map will take care of granule alignment. |
| |
| Fixes: 1f221a0d0dbf ("swiotlb: respect min_align_mask") |
| Signed-off-by: David Stevens <stevensd@chromium.org> |
| Link: https://lore.kernel.org/r/20210929023300.335969-8-stevensd@google.com |
| Signed-off-by: Joerg Roedel <jroedel@suse.de> |
| |
| (cherry picked from commit 2cbc61a1b1665c84282dbf2b1747ffa0b6248639 |
| git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu.git core) |
| |
| Conflicts: |
| drivers/iommu/dma-iommu.c |
| |
| BUG=b:167731151, b:200576547 |
| TEST=TEST=1)Build and boot on Volteer/Brya and do not see any new errors. |
| 2)Test data transfer on an external thunderbolt NVME (untrusted |
| device) on volteer. |
| |
| Signed-off-by: Rajat Jain <rajatja@google.com> |
| Change-Id: Ib296644c1fe32c695a8197f6a222e2a9c972d08f |
| Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/3134508 |
| Reviewed-by: David Stevens <stevensd@chromium.org> |
| Reviewed-by: Benson Leung <bleung@google.com> |
| --- |
| drivers/iommu/dma-iommu.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c |
| --- a/drivers/iommu/dma-iommu.c |
| +++ b/drivers/iommu/dma-iommu.c |
| @@ -599,7 +599,7 @@ static dma_addr_t __iommu_dma_map_swiotlb(struct device *dev, phys_addr_t phys, |
| if (!coherent && !(attrs & DMA_ATTR_SKIP_CPU_SYNC)) |
| arch_sync_dma_for_device(phys, org_size, dir); |
| |
| - iova = __iommu_dma_map(dev, phys, aligned_size, prot, dma_mask); |
| + iova = __iommu_dma_map(dev, phys, org_size, prot, dma_mask); |
| if (iova == DMA_MAPPING_ERROR && is_swiotlb_buffer(dev, phys)) |
| swiotlb_tbl_unmap_single(dev, phys, org_size, dir, attrs); |
| return iova; |
| -- |
| 2.33.0.1079.g6e70778dc9-goog |
| |
