WORKAROUND: iommu/arm-smmu: Work around Qualcomm SMMU-500 TLBIVAL gra…

[Sibi Sankar (QuinAsura)]

Qualcomm SMMU-500 has an issue with TLBIVA/TLBIVAL where only the base-page-size entry at the base IOVA is invalidated, leaving stale TLB entries for the rest of the range.

This causes use-after-free: after dma_free_coherent() unmaps a large buffer, the device can still access freed physical memory through stale TLB entries. On FastRPC workloads this manifests as ADSP crashes when the ELF loader writes to a freed PA that has been reallocated.

Force the TLB invalidation step granule to the minimum page size for all Qualcomm SMMU-500 domains, ensuring each page in the range is individually invalidated. The minimum page size from pgsize_bitmap is used rather than hardcoded 4K to correctly handle 16K and 64K granule configurations.

This increases the number of TLB invalidation operations for large ranges, but correctness takes precedence.

Isolate the fix to affect just Glymur/Mahua/Kalambo SoCs since it is currently the only platform that boots at EL2 by default.

[qlijarvis]

PR #1550 — validate-patch

PR: #1550

Verdict	Issues	Detailed Report
✅	0	Full report

Final Summary

1. Lore link present: No — WORKAROUND: prefix; no lore link expected or required
2. Lore link matches PR commits: N/A — no lore link to compare against
3. Upstream patch status: N/A — vendor-only workaround, not suitable for upstream
4. PR present in qcom-next/topics: Fail - 1/1 commit(s) are missing from both qcom-next and topics

Verdict: ✅ — click to expand

🔍 Patch Validation

PR: #1550 - WORKAROUND: iommu/arm-smmu: Work around Qualcomm SMMU-500 TLBIVAL granule issue
Upstream commit: N/A (vendor-only workaround)
Verdict: ✅ PASS

Commit Message

Check	Status	Note
Subject matches upstream	N/A	Vendor-only workaround; no upstream source
Body preserves rationale	✅	Clear problem description, impact analysis, and solution rationale
Fixes tag present/correct	N/A	New workaround; no upstream commit to reference
Authorship preserved	✅	Primary author in From:, co-developer properly signed off
Backport note (if applicable)	N/A	Not a backport

Diff

File	Status	Notes
drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c	✅	Adds Glymur-specific SMMU-500 workaround flag
drivers/iommu/arm/arm-smmu/arm-smmu.c	✅	Implements TLB invalidation granule override
drivers/iommu/arm/arm-smmu/arm-smmu.h	✅	Adds config flag for forced minimum granule

Issues

None. The commit message is well-structured with clear problem statement, impact analysis (use-after-free, ADSP crashes on FastRPC workloads), and solution rationale. The code changes are minimal and focused.

Verdict

Merge as-is. This is a properly documented vendor-only workaround for a Qualcomm SMMU-500 hardware issue affecting Glymur SoCs.

Final Summary

1. Lore link present: No — WORKAROUND: prefix; no lore link expected or required
2. Lore link matches PR commits: N/A — no lore link to compare against
3. Upstream patch status: N/A — vendor-only workaround, not suitable for upstream
4. PR present in qcom-next/topics: No — new workaround being introduced (missing from both qcom-next and topics per integration_presence_report.md)

Deterministic Integration Presence

Integration Presence Report

This report is generated by Jarvis before validate-patch runs.
It is the authoritative source for whether PR changes are already present
in qcom-next or in the kernel topic branches.

Kernel repo: /local/mnt/workspace/sgaud/Qgenie/image_pipeline/kernel
qcom-next ref: 07f50dc44eddcf748a99d1a7523a466438bfffa6
topics remote: topics -> https://github.com/qualcomm-linux/kernel-topics
topics fetch: fetched

Commit	Subject	qcom-next	topics	Final
1/1	[PATCH] WORKAROUND: iommu/arm-smmu: Work around Qualcomm SMMU-500	missing - no subject, patch-id, or full tree-content match found	missing - no subject, patch-id, or full tree-content match found	missing

Final Status

overall_status: FAIL
present_commits: 0/1
partial_commits: 0/1
missing_commits: 1/1
topics_checked_for_commits: 1/1
final_summary: PR present in qcom-next/topics: Fail - 1/1 commit(s) are missing from both qcom-next and topics

[qlijarvis]

PR #1550 — checker-log-analyzer

PR: #1550
Checker run: https://github.com/qualcomm-linux/kernel-config/actions/runs/29916296137

Checker	Result	Summary
Checker	Result	Summary
checkpatch	✅	No style issues
dt-binding-check	⏭️	No binding changes
dtb-check	⏭️	No DTS changes
sparse-check	✅	No static analysis warnings
check-uapi-headers	✅	No UAPI changes
check-patch-compliance	❌	WORKAROUND: prefix not accepted
tag-check	✅	Subject has valid prefix (WORKAROUND:)

Detailed report: Full report

Checker analysis — click to expand

🤖 CI Checker Analysis (checker-log-analyzer)

PR: #1550 — WORKAROUND: iommu/arm-smmu: Work around Qualcomm SMMU-500 TLBIVAL granule issue
Source: https://github.com/qualcomm-linux/kernel-config/actions/runs/29916296137

Checker	Result	Summary
checkpatch	✅	No style issues
dt-binding-check	⏭️	No binding changes
dtb-check	⏭️	No DTS changes
sparse-check	✅	No static analysis warnings
check-uapi-headers	✅	No UAPI changes
check-patch-compliance	❌	WORKAROUND: prefix not accepted
tag-check	✅	Subject has valid prefix (WORKAROUND:)

---

❌ check-patch-compliance

Root cause: The commit uses the WORKAROUND: prefix, which is not in the checker's allowed list.

Failure details:

Checking commit: WORKAROUND: iommu/arm-smmu: Work around Qualcomm SMMU-500 TLBIVAL granule issue
Commit summary does not start with a required prefix

Analysis:

The check-patch-compliance checker enforces a strict subset of upstream-linkable prefixes:

• ✅ Accepted: FROMLIST:, FROMGIT:, UPSTREAM:, BACKPORT:
• ❌ Rejected: WORKAROUND:, QCLINUX:, PENDING:

This is a known checker limitation for vendor-only commits. The commit is correctly prefixed with WORKAROUND: (which is a valid prefix for the tech/all/workaround branch), but check-patch-compliance does not recognize it.

Why this happens:

check-patch-compliance is designed to validate that patches have upstream provenance (posted to lore.kernel.org or merged into a maintainer tree). Vendor-internal prefixes like WORKAROUND:, QCLINUX:, and PENDING: indicate commits that have no upstream equivalent, so the checker always fails for them.

Options:

1. Accept the failure — This is a known limitation. The commit is correctly tagged for a vendor workaround branch. No patch change is needed.

2. Add a Link: trailer — If the workaround was discussed on a mailing list or in a public bug tracker, add a Link: trailer to the commit body. This may satisfy the checker even with the WORKAROUND: prefix (though the prefix check will still fail).

3. Change prefix to FROMLIST: or UPSTREAM: — Only if the patch was actually posted upstream or merged into a maintainer tree. Do not change the prefix if this is a vendor-only workaround.

Recommendation: Accept the failure. The commit is correctly tagged for the tech/all/workaround branch. The checker limitation is documented and expected for vendor-only commits.

Reproduce locally:

cd kernel
git log --oneline -1 c20ee59ffd8d
# Verify subject starts with WORKAROUND:

---

Verdict

1 known checker limitation — The check-patch-compliance failure is expected for vendor-only WORKAROUND: commits. All other checkers passed. The commit is correctly formatted and ready to merge into tech/all/workaround.