From patchwork Thu Jul 12 09:28:43 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Zhen Lei X-Patchwork-Id: 141811 Delivered-To: patch@linaro.org Received: by 2002:a2e:9754:0:0:0:0:0 with SMTP id f20-v6csp1283977ljj; Thu, 12 Jul 2018 02:30:59 -0700 (PDT) X-Google-Smtp-Source: AAOMgpecZlDqul8sJ4nbtPKjAaVzXKSbR1J94rIksfiN5Vpgq5ZWvXBd3XAL95Gir+PwqqTVBsO5 X-Received: by 2002:a63:1262:: with SMTP id 34-v6mr1438508pgs.154.1531387859076; Thu, 12 Jul 2018 02:30:59 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1531387859; cv=none; d=google.com; s=arc-20160816; b=E+iRjURBaBnbL7SZ8+dyk1qfQx/lbl8dFuYNRnXAZ1bjMDlXuIetG6YUfgExeqCgJ3 +7ApyoxoM39YC/17AaNMnO6tvWJ7AAv6+N2vsG5RLaZMHe5FcklZTSOnl0mAEkQ8cQkX lsgfn0tIvaT2U7njdbcVgY76iPiQWjUYzTBW3gUWmNbeypLhxnPGg9cMk2hNWLtuLOE1 Y6OA5slAcxWgzCf/GKoAOQdyH8Ypqxdl350Oiqukh5uLeqBU4vg9zcIYPJEyAOo60YCE Y4xL3/HDYV0H3xlcf3L+6tgmtihs6HwQQUVRsApMUpayLmTVYFzV+2hizqkoHPGuR7L9 gjjQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:mime-version:message-id:date:subject:cc :to:from:arc-authentication-results; bh=IdITnn9hxEQnc9LNl7JJs6vICq8sU9H7MZ1UhZY2ik4=; b=qBmWMLkuKAQ4LsoUe8jDVDxJZA+jt6Qo0GjaGSrEmwHBhB3eednli3p5FVPQEMn1sH nVJ1u73EkLx8eHniyXfGKfwwmfrcz2twiJgcerEAPFPzntjtJ+NLxEeC3GH342pLXekc dw52hKJpq/o7RsFaCk4T70rm2dvjbRec3k9VYPxqm8T6/9Uk7yqdBIlZ8WVABjBhf7xT TfqBV3cAcZ1rm5UfPMjjMF/sqjY/tclliKpsMX3dihzaN0angFvLOQhYhUz7FNXnOBhK eGxZ+X5pNaRwq8u6Cnnse4TDIXFNO6Ue4Cpb9AblnyL8Mqg34Cge2hN3QhpMxwc67w6H sH2A== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id a62-v6si21339656pge.262.2018.07.12.02.30.58; Thu, 12 Jul 2018 02:30:59 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726548AbeGLJiz (ORCPT + 28 others); Thu, 12 Jul 2018 05:38:55 -0400 Received: from szxga06-in.huawei.com ([45.249.212.32]:57878 "EHLO huawei.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1725833AbeGLJiz (ORCPT ); Thu, 12 Jul 2018 05:38:55 -0400 Received: from DGGEMS403-HUB.china.huawei.com (unknown [172.30.72.60]) by Forcepoint Email with ESMTP id 3A72BC74B22E8; Thu, 12 Jul 2018 17:30:07 +0800 (CST) Received: from localhost (10.177.23.164) by DGGEMS403-HUB.china.huawei.com (10.3.19.203) with Microsoft SMTP Server id 14.3.382.0; Thu, 12 Jul 2018 17:29:59 +0800 From: Zhen Lei To: Jean-Philippe Brucker , Robin Murphy , Will Deacon , Joerg Roedel , linux-arm-kernel , iommu , linux-kernel CC: Zhen Lei Subject: [PATCH 1/1] iommu/arm-smmu-v3: prevent any devices access to memory without registration Date: Thu, 12 Jul 2018 17:28:43 +0800 Message-ID: <1531387723-3592-1-git-send-email-thunder.leizhen@huawei.com> X-Mailer: git-send-email 1.9.5.msysgit.0 MIME-Version: 1.0 X-Originating-IP: [10.177.23.164] X-CFilter-Loop: Reflected Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Stream bypass is not security. A malicious device can be hot plugged without match any drivers, but it can access to any memory. So change to disable bypass by default. Signed-off-by: Zhen Lei --- drivers/iommu/arm-smmu-v3.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 1.8.3 diff --git a/drivers/iommu/arm-smmu-v3.c b/drivers/iommu/arm-smmu-v3.c index 1d64710..b0ec28d 100644 --- a/drivers/iommu/arm-smmu-v3.c +++ b/drivers/iommu/arm-smmu-v3.c @@ -366,7 +366,7 @@ #define MSI_IOVA_BASE 0x8000000 #define MSI_IOVA_LENGTH 0x100000 -static bool disable_bypass; +static bool disable_bypass = 1; module_param_named(disable_bypass, disable_bypass, bool, S_IRUGO); MODULE_PARM_DESC(disable_bypass, "Disable bypass streams such that incoming transactions from devices that are not attached to an iommu domain will report an abort back to the device and will not be allowed to pass through the SMMU.");