Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'iommu-fix-v5.8-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu into master
Pull iommu fix from Joerg Roedel:
"Fix a NULL-ptr dereference in the QCOM IOMMU driver"
* tag 'iommu-fix-v5.8-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu:
iommu/qcom: Use domain rather than dev as tlb cookie
+17
-20
+17
-20
drivers/iommu/qcom_iommu.c
+17
-20
drivers/iommu/qcom_iommu.c
···
65
65
struct mutex init_mutex; /* Protects iommu pointer */
66
66
struct iommu_domain domain;
67
67
struct qcom_iommu_dev *iommu;
68
+
struct iommu_fwspec *fwspec;
68
69
};
69
70
70
71
static struct qcom_iommu_domain *to_qcom_iommu_domain(struct iommu_domain *dom)
···
85
84
return dev_iommu_priv_get(dev);
86
85
}
87
86
88
-
static struct qcom_iommu_ctx * to_ctx(struct device *dev, unsigned asid)
87
+
static struct qcom_iommu_ctx * to_ctx(struct qcom_iommu_domain *d, unsigned asid)
89
88
{
90
-
struct qcom_iommu_dev *qcom_iommu = to_iommu(dev);
89
+
struct qcom_iommu_dev *qcom_iommu = d->iommu;
91
90
if (!qcom_iommu)
92
91
return NULL;
93
92
return qcom_iommu->ctxs[asid - 1];
···
119
118
120
119
static void qcom_iommu_tlb_sync(void *cookie)
121
120
{
122
-
struct iommu_fwspec *fwspec;
123
-
struct device *dev = cookie;
121
+
struct qcom_iommu_domain *qcom_domain = cookie;
122
+
struct iommu_fwspec *fwspec = qcom_domain->fwspec;
124
123
unsigned i;
125
124
126
-
fwspec = dev_iommu_fwspec_get(dev);
127
-
128
125
for (i = 0; i < fwspec->num_ids; i++) {
129
-
struct qcom_iommu_ctx *ctx = to_ctx(dev, fwspec->ids[i]);
126
+
struct qcom_iommu_ctx *ctx = to_ctx(qcom_domain, fwspec->ids[i]);
130
127
unsigned int val, ret;
131
128
132
129
iommu_writel(ctx, ARM_SMMU_CB_TLBSYNC, 0);
···
138
139
139
140
static void qcom_iommu_tlb_inv_context(void *cookie)
140
141
{
141
-
struct device *dev = cookie;
142
-
struct iommu_fwspec *fwspec;
142
+
struct qcom_iommu_domain *qcom_domain = cookie;
143
+
struct iommu_fwspec *fwspec = qcom_domain->fwspec;
143
144
unsigned i;
144
145
145
-
fwspec = dev_iommu_fwspec_get(dev);
146
-
147
146
for (i = 0; i < fwspec->num_ids; i++) {
148
-
struct qcom_iommu_ctx *ctx = to_ctx(dev, fwspec->ids[i]);
147
+
struct qcom_iommu_ctx *ctx = to_ctx(qcom_domain, fwspec->ids[i]);
149
148
iommu_writel(ctx, ARM_SMMU_CB_S1_TLBIASID, ctx->asid);
150
149
}
151
150
···
153
156
static void qcom_iommu_tlb_inv_range_nosync(unsigned long iova, size_t size,
154
157
size_t granule, bool leaf, void *cookie)
155
158
{
156
-
struct device *dev = cookie;
157
-
struct iommu_fwspec *fwspec;
159
+
struct qcom_iommu_domain *qcom_domain = cookie;
160
+
struct iommu_fwspec *fwspec = qcom_domain->fwspec;
158
161
unsigned i, reg;
159
162
160
163
reg = leaf ? ARM_SMMU_CB_S1_TLBIVAL : ARM_SMMU_CB_S1_TLBIVA;
161
164
162
-
fwspec = dev_iommu_fwspec_get(dev);
163
-
164
165
for (i = 0; i < fwspec->num_ids; i++) {
165
-
struct qcom_iommu_ctx *ctx = to_ctx(dev, fwspec->ids[i]);
166
+
struct qcom_iommu_ctx *ctx = to_ctx(qcom_domain, fwspec->ids[i]);
166
167
size_t s = size;
167
168
168
169
iova = (iova >> 12) << 12;
···
251
256
};
252
257
253
258
qcom_domain->iommu = qcom_iommu;
254
-
pgtbl_ops = alloc_io_pgtable_ops(ARM_32_LPAE_S1, &pgtbl_cfg, dev);
259
+
qcom_domain->fwspec = fwspec;
260
+
261
+
pgtbl_ops = alloc_io_pgtable_ops(ARM_32_LPAE_S1, &pgtbl_cfg, qcom_domain);
255
262
if (!pgtbl_ops) {
256
263
dev_err(qcom_iommu->dev, "failed to allocate pagetable ops\n");
257
264
ret = -ENOMEM;
···
266
269
domain->geometry.force_aperture = true;
267
270
268
271
for (i = 0; i < fwspec->num_ids; i++) {
269
-
struct qcom_iommu_ctx *ctx = to_ctx(dev, fwspec->ids[i]);
272
+
struct qcom_iommu_ctx *ctx = to_ctx(qcom_domain, fwspec->ids[i]);
270
273
271
274
if (!ctx->secure_init) {
272
275
ret = qcom_scm_restore_sec_cfg(qcom_iommu->sec_id, ctx->asid);
···
416
419
417
420
pm_runtime_get_sync(qcom_iommu->dev);
418
421
for (i = 0; i < fwspec->num_ids; i++) {
419
-
struct qcom_iommu_ctx *ctx = to_ctx(dev, fwspec->ids[i]);
422
+
struct qcom_iommu_ctx *ctx = to_ctx(qcom_domain, fwspec->ids[i]);
420
423
421
424
/* Disable the context bank: */
422
425
iommu_writel(ctx, ARM_SMMU_CB_SCTLR, 0);