Commit 54c80d90 authored by Lu Baolu's avatar Lu Baolu Committed by Joerg Roedel
Browse files

iommu/vt-d: Use user privilege for RID2PASID translation 



When first-level page tables are used for IOVA translation, we use user
privilege by setting U/S bit in the page table entry. This is to make it
consistent with the second level translation, where the U/S enforcement
is not available. Clear the SRE (Supervisor Request Enable) field in the
pasid table entry of RID2PASID so that requests requesting the supervisor
privilege are blocked and treated as DMA remapping faults.

Fixes: b802d070 ("iommu/vt-d: Use iova over first level")
Suggested-by: default avatarJacob Pan <jacob.jun.pan@linux.intel.com>
Signed-off-by: default avatarLu Baolu <baolu.lu@linux.intel.com>
Link: https://lore.kernel.org/r/20210512064426.3440915-1-baolu.lu@linux.intel.com
Link: https://lore.kernel.org/r/20210519015027.108468-3-baolu.lu@linux.intel.com


Signed-off-by: default avatarJoerg Roedel <jroedel@suse.de>
parent 1a590a1c

drivers/iommu/intel/iommu.c

+5 −2
Original line number Diff line number Diff line
@@ -2525,9 +2525,9 @@ static int domain_setup_first_level(struct intel_iommu *iommu, 
				    struct device *dev,

				    u32 pasid)

{

	int flags = PASID_FLAG_SUPERVISOR_MODE;

	struct dma_pte *pgd = domain->pgd;

	int agaw, level;

	int flags = 0;



	/*

	 * Skip top levels of page tables for iommu which has
@@ -2543,7 +2543,10 @@ static int domain_setup_first_level(struct intel_iommu *iommu, 
	if (level != 4 && level != 5)

		return -EINVAL;



	flags |= (level == 5) ? PASID_FLAG_FL5LP : 0;

	if (pasid != PASID_RID2PASID)

		flags |= PASID_FLAG_SUPERVISOR_MODE;

	if (level == 5)

		flags |= PASID_FLAG_FL5LP;



	if (domain->domain.type == IOMMU_DOMAIN_UNMANAGED)

		flags |= PASID_FLAG_PAGE_SNOOP;

drivers/iommu/intel/pasid.c

+2 −1
Original line number Diff line number Diff line
@@ -699,6 +699,7 @@ int intel_pasid_setup_second_level(struct intel_iommu *iommu, 
	 * Since it is a second level only translation setup, we should

	 * set SRE bit as well (addresses are expected to be GPAs).

	 */

	if (pasid != PASID_RID2PASID)

		pasid_set_sre(pte);

	pasid_set_present(pte);

	pasid_flush_caches(iommu, pte, pasid, did);