From c20ee59ffd8db0acea46dcd86ed4e14765019acb Mon Sep 17 00:00:00 2001 From: Prakash Gupta Date: Tue, 14 Jul 2026 15:57:00 +0530 Subject: [PATCH] WORKAROUND: iommu/arm-smmu: Work around Qualcomm SMMU-500 TLBIVAL granule issue Qualcomm SMMU-500 has an issue with TLBIVA/TLBIVAL where only the base-page-size entry at the base IOVA is invalidated, leaving stale TLB entries for the rest of the range. This causes use-after-free: after dma_free_coherent() unmaps a large buffer, the device can still access freed physical memory through stale TLB entries. On FastRPC workloads this manifests as ADSP crashes when the ELF loader writes to a freed PA that has been reallocated. Force the TLB invalidation step granule to the minimum page size for all Qualcomm SMMU-500 domains, ensuring each page in the range is individually invalidated. The minimum page size from pgsize_bitmap is used rather than hardcoded 4K to correctly handle 16K and 64K granule configurations. This increases the number of TLB invalidation operations for large ranges, but correctness takes precedence. Signed-off-by: Prakash Gupta Signed-off-by: Sibi Sankar --- drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c | 9 +++++++++ drivers/iommu/arm/arm-smmu/arm-smmu.c | 10 ++++++++++ drivers/iommu/arm/arm-smmu/arm-smmu.h | 1 + 3 files changed, 20 insertions(+) diff --git a/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c b/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c index e2c914fccd6f..4a98e5815903 100644 --- a/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c +++ b/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c @@ -438,6 +438,15 @@ static int qcom_smmu_init_context(struct arm_smmu_domain *smmu_domain, int cbndx = smmu_domain->cfg.cbndx; smmu_domain->cfg.flush_walk_prefer_tlbiasid = true; + /* + * Qualcomm SMMU-500 has an issue with TLBIVA/TLBIVAL where only + * the base-page-size entry at the base IOVA is invalidated. Glymur + * SoCs boot by default at EL2 and is the currently the only SoC + * affected by it. Force the minimum page granule to ensure the full + * range is covered. + */ + if (of_device_is_compatible(smmu->dev->of_node, "qcom,glymur-smmu-500")) + smmu_domain->cfg.force_min_tlbival_granule = true; client_match = qsmmu->data->client_match; diff --git a/drivers/iommu/arm/arm-smmu/arm-smmu.c b/drivers/iommu/arm/arm-smmu/arm-smmu.c index 0bd21d206eb3..75657c74f291 100644 --- a/drivers/iommu/arm/arm-smmu/arm-smmu.c +++ b/drivers/iommu/arm/arm-smmu/arm-smmu.c @@ -286,6 +286,16 @@ static void arm_smmu_tlb_inv_range_s1(unsigned long iova, size_t size, struct arm_smmu_cfg *cfg = &smmu_domain->cfg; int idx = cfg->cbndx; + /* + * Override the step granule with the minimum supported page size. + * Placed here (rather than in tlb_add_page alone) to cover both + * TLBIVAL and TLBIVA paths. + */ + if (cfg->force_min_tlbival_granule) { + WARN_ON_ONCE(!smmu_domain->domain.pgsize_bitmap); + granule = 1UL << __ffs(smmu_domain->domain.pgsize_bitmap); + } + if (smmu->features & ARM_SMMU_FEAT_COHERENT_WALK) wmb(); diff --git a/drivers/iommu/arm/arm-smmu/arm-smmu.h b/drivers/iommu/arm/arm-smmu/arm-smmu.h index 26d2e33cd328..85d1f2d7ec50 100644 --- a/drivers/iommu/arm/arm-smmu/arm-smmu.h +++ b/drivers/iommu/arm/arm-smmu/arm-smmu.h @@ -359,6 +359,7 @@ struct arm_smmu_cfg { enum arm_smmu_cbar_type cbar; enum arm_smmu_context_fmt fmt; bool flush_walk_prefer_tlbiasid; + bool force_min_tlbival_granule; }; #define ARM_SMMU_INVALID_IRPTNDX 0xff