From 2b76a993f6cec01a37a97c6ec21dcb98bc4cac4c Mon Sep 17 00:00:00 2001 From: Jean-Philippe Brucker Date: Sat, 18 May 2019 22:09:53 +0800 Subject: [PATCH] iommu/arm-smmu-v3: Disable tagged pointers hulk inclusion category: feature bugzilla: 14369 CVE: NA ------------------- The ARM architecture has a "Top Byte Ignore" (TBI) option that makes the MMU mask out bits [63:56] of an address, allowing a userspace application to store data in its pointers. This option is incompatible with PCI ATS. If TBI is enabled in the SMMU and userspace triggers DMA transactions on tagged pointers, the endpoint might create ATC entries for addresses that include a tag. Software would then have to send ATC invalidation packets for each 255 possible alias of an address, or just wipe the whole address space. This is not a viable option, so disable TBI. The impact of this change is unclear, since there are very few users of tagged pointers, much less SVA. But the requirement introduced by this patch doesn't seem excessive: a userspace application using both tagged pointers and SVA should now sanitize addresses (clear the tag) before using them for device DMA. Signed-off-by: Jean-Philippe Brucker Signed-off-by: Fang Lijun Reviewed-by: Hanjun Guo Reviewed-by: Zhen Lei Signed-off-by: Yang Yingliang --- drivers/iommu/arm-smmu-v3-context.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/iommu/arm-smmu-v3-context.c b/drivers/iommu/arm-smmu-v3-context.c index eb1c916f8f09..2351de86d31f 100644 --- a/drivers/iommu/arm-smmu-v3-context.c +++ b/drivers/iommu/arm-smmu-v3-context.c @@ -200,7 +200,6 @@ static u64 arm_smmu_cpu_tcr_to_cd(struct arm_smmu_context_cfg *cfg, u64 tcr) val |= ARM_SMMU_TCR2CD(tcr, EPD0); val |= ARM_SMMU_TCR2CD(tcr, EPD1); val |= ARM_SMMU_TCR2CD(tcr, IPS); - val |= ARM_SMMU_TCR2CD(tcr, TBI0); if (cfg->hw_access) val |= ARM_SMMU_TCR2CD(tcr, HA); -- GitLab