aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorZhen Lei <thunder.leizhen@huawei.com>2018-07-12 17:28:43 +0800
committerWill Deacon <will.deacon@arm.com>2018-07-27 11:12:33 +0100
commita71792dee2a33d2e935d4b67dd63924f5ceb203d (patch)
treeda4d8a9ad7db123d88ddda6f9bd7ded1bb102615
parent0d535967ac658966c6ade8f82b5799092f7d5441 (diff)
download96b-common-a71792dee2a33d2e935d4b67dd63924f5ceb203d.tar.gz
iommu/arm-smmu-v3: Prevent any devices access to memory without registration
Stream bypass is a potential security hole since a malicious device can be hotplugged in without matching any drivers, yet be granted the ability to access all of physical memory. Now that we attach devices to domains by default, we can toggle the disable_bypass default to "on", preventing DMA from unknown devices. Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com> Signed-off-by: Will Deacon <will.deacon@arm.com>
-rw-r--r--drivers/iommu/arm-smmu-v3.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/iommu/arm-smmu-v3.c b/drivers/iommu/arm-smmu-v3.c
index deacc152f09f..7fb5230cd145 100644
--- a/drivers/iommu/arm-smmu-v3.c
+++ b/drivers/iommu/arm-smmu-v3.c
@@ -366,7 +366,7 @@
#define MSI_IOVA_BASE 0x8000000
#define MSI_IOVA_LENGTH 0x100000
-static bool disable_bypass;
+static bool disable_bypass = 1;
module_param_named(disable_bypass, disable_bypass, bool, S_IRUGO);
MODULE_PARM_DESC(disable_bypass,
"Disable bypass streams such that incoming transactions from devices that are not attached to an iommu domain will report an abort back to the device and will not be allowed to pass through the SMMU.");